Advisories › Rockwell Automation › ICSA-26-246-05
Rockwell Automation 1756-ENBT Module: 1 CVE, High 7.5
Summary
CISA reports 1 vulnerability in Rockwell Automation 1756-ENBT module. Weakness type: Improper Check for Unusual or Exceptional Conditions. Successful exploitation of this vulnerability could crash the module. The device requires a restart to recover. Highest CVSS v3 score: 7.5 (High), exploitable over the network.
What to do: Prioritize: Rockwell Automation recommends that users upgrade to 1756-EN2T or 1756-EN4TR. Users who are not able to upgrade should use Rockwell Automation's security best practices.
Why this matters for oil & gas: Rockwell Automation (ControlLogix, FactoryTalk, PlantPAx) is common on facilities and compressor stations.
At a glance
- Vendor
- Rockwell Automation
- Products
- 1756-ENBT module
- CVEs
- CVE-2025-10478
- Highest CVSS v3
- 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Food and Agriculture, Transportation Systems, Water and Wastewater
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2025-10478 | Improper Check for Unusual or Exceptional Conditions | 7.5 | – | No | A denial-of-service security issue exists in the Rockwell Automation 1756-ENBT module which is a ControlLogix EtherNet/IP bridge that enables communication between Logix 5000 controllers and Ethernet devices. An attacker could exploit this vulnerability by sending a crafted CIP packet, causing the module to crash. The device requires a restart to recover. |
Affected products (1)
- Rockwell Automation 1756-ENBT module: vers:all/*
Vendor fixes and mitigations (from advisory)
- Mitigation: Rockwell Automation recommends that users upgrade to 1756-EN2T or 1756-EN4TR. Users who are not able to upgrade should use Rockwell Automation's security best practices. link
- Mitigation: For more information on this issue, see the corresponding Rockwell Automation security advisory. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.