Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT
CISA alerts Rockwell Automation 1756-EN2/EN3/ENBT DoS vulnerability via CIP packet validation flaw.
CISA released an advisory for CVE-2026-9653 affecting Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT communication modules. The vulnerability stems from improper validation of CIP Implicit Connection packets, allowing network-based attackers to send crafted packets that cause denial-of-service by disrupting device connections (though connections recover immediately). Rockwell recommends updating EN2 and EN3 to V12.002, while the EN3BT is discontinued with no fix available.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Rockwell Automation?
Get an email when a new story names Rockwell Automation, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCVE-2026-9653 exposes Rockwell Automation 1756-EN2, EN3, and ENBT communication modules to denial-of-service attacks due to improper validation of CIP Implicit Connection packets, allowing any network-reachable attacker to disrupt device communications. This is particularly critical in industrial control system (ICS) environments where even brief disruptions can halt production lines or compromise safety systems. The discontinued EN3BT module has no available patch, leaving operators permanently exposed unless they replace the hardware entirely. This highlights the compounded risk of running end-of-life ICS components in operational technology (OT) environments where upgrades are often deferred.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-9653