CISA 2026-07-16

Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT

CVE-2026-9653

Machine-generated analysis · WAYSCloud LLM

The advisory reports that crafted CIP Implicit Connection packets can cause a denial-of-service condition on the affected modules. Rockwell Automation provides firmware updates for EN2 and EN3 but none for ENBT.

Context

The advisory concerns Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT communication modules. Improper validation of CIP Implicit Connection packets can allow an attacker on the network to cause a denial-of-service condition, though connections recover immediately after. The ENBT version V6.006 is discontinued and no vendor fix is available.

Operator considerations

Check: Verify the firmware version of each module against the listed affected versions.
Isolate: Limit network exposure of the modules, for example by placing them on a segmented VLAN.
Patch: Update EN2 and EN3 to firmware V12.002; no fix is provided for ENBT.
Log: Monitor network traffic for abnormal CIP Implicit Connection packet patterns.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.

The following versions of Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT are affected:

1756-EN3

Read the full advisory on CISA →