CISA republishes Rockwell advisory on 1756-ENBT denial-of-service flaw

By Atlas Watchline Staff · Regulatory · September 3, 2026

CISA republished an advisory on Sept. 3 warning that a flaw in Rockwell Automation’s 1756-ENBT module can crash the device and require a restart.

CISA republished an advisory on Sept. 3 about a denial-of-service vulnerability in Rockwell Automation’s 1756-ENBT module, a ControlLogix EtherNet/IP bridge used to communicate between Logix 5000 controllers and Ethernet devices.

The issue, tracked as CVE-2025-10478, could let an attacker send a crafted CIP packet that crashes the module, according to the advisory. CISA said the device must be restarted to recover.

CISA said the module is listed as known affected and is deployed worldwide, with use in critical manufacturing, food and agriculture, transportation systems, and water and wastewater. The agency described the flaw as a high-severity denial-of-service issue and mapped it to CWE-754, or improper check for unusual or exceptional conditions.

The advisory said the vulnerability carries a CVSS v3.1 base score of 7.5 and a CVSS v4.0 base score of 8.7, both rated high. The affected version is listed as 1756-ENBT module vers:all/*. Rockwell Automation reported the vulnerability to CISA, and CISA said it had no known public exploitation specifically targeting this issue at the time of publication.

For users that can patch or replace the hardware, CISA relayed Rockwell Automation’s recommendation to upgrade to 1756-EN2T or 1756-EN4TR. If an upgrade is not possible, CISA said users should follow Rockwell Automation’s security best practices and consult the company’s advisory.

The advisory also repeats standard guidance for industrial control systems, including minimizing network exposure, keeping devices off the internet when possible, isolating control system networks from business networks, placing remote devices behind firewalls and using more secure remote access methods such as VPNs when remote access is needed.

CISA’s notice lists the United States as the company headquarters location and says the product is used worldwide. The advisory was initially released on Sept. 3, 2026, and its revision history shows the same date for the republication of Rockwell Automation’s security advisory.

What happens next

Operators using the 1756-ENBT module will need to decide whether to upgrade hardware or rely on Rockwell Automation’s recommended security measures and network protections.

Sources

• CISA Cybersecurity Advisories

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.