Rockwell Automation FLEX I/O Adapter CVE-2026-0646 DoS and CVE-2026-0647 Pre-Auth Vulnerability Advisory

Vulnerability Overview Rockwell Automation's FLEX I/O Dual-port EtherNet/IP Adapters are affected by multiple security vulnerabilities, specifically: 1. CVE-2026-0646 - Impact: Denial of Service (DoS) vulnerability caused by improper handling of CIP protocol requests, which may result in adapter failure and require a manual reset to recover. - CVSS 3.1 Base Score: 7.5/10 - CVSS 4.0 Base Score: 8.7/10 - CWE: CWE-401 - Missing Release of Memory after Effective Lifetime 2. CVE-2026-0647 - Impact: Improper Authentication vulnerability allowing unauthenticated attackers to change the device's web interface password by sending crafted HTTP GET requests, resulting in unauthorized access, account takeover, and loss of availability of the device's embedded web server. - CVSS 3.1 Base Score: 9.4/10 - CVSS 4.0 Base Score: 8.8/10 - CWE: CWE-306 - Missing Authentication for Critical Function Affected Products Affected Product: FLEX I/O EtherNet/IP Adapters Affected Firmware Version: 2.012 Fixed Firmware Version: 2.013 Affected Catalog Numbers: T794-AENTR/T794-AENTRT Remediation Firmware Update: It is recommended to update the firmware to version 2.013 to remediate the aforementioned vulnerabilities. Security Measures: For customers unable to upgrade to the fixed version, best security practices should be employed to mitigate risks. Additional Information Release Date: June 16, 2026 Last Updated: June 16, 2026 Revision: 1.0 Known Exploits: No Mitigation: No specific mitigations; adherence to best security practices is recommended. Contact and Support Technical Support: For any questions regarding security issues, please contact TechConnect. Report Security Issues: Possible security issues can be reported via the Rockwell Automation website. Legal Disclaimer Rockwell Automation does not warrant the completeness, timeliness, or accuracy of the content on the website and reserves the right to change the content at any time. --- The above summarizes the key vulnerability information extracted from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

Rockwell Automation FLEX I/O Adapter CVE-2026-0646 DoS and CVE-2026-0647 Pre-Auth Vulnerability Advisory