Rockwell Automation 1715 Redundant I/O CVE-2026-10577 Access Control Vulnerability

Vulnerability Overview Title: 1715 Redundant IO – Access Control Vulnerability Severity: Critical CVE ID: CVE-2026-10577 Publish Date: July 14, 2026 Last Updated Date: July 14, 2026 Revision Number: 1.0 Known Exploited Vulnerabilities (KEV): No Remediation Available: Yes Workarounds: No Affected Products Affected Product: 1715 Redundant I/O CVE ID: CVE-2026-10577 Affected Versions: 3.003 and earlier Fixed Version: 3.011 Product Model: 1715-AENTR Remediation Fixed Version: 3.011 Workarounds: None Details Category: CVE ID CVE ID: CVE-2026-10577 Impact: A security vulnerability exists in the 1715-AENTR EtherNet/IP adapter where a network-accessible debug port is exposed. If proper access controls are not implemented, an unauthorized remote access command-line interface (CLI) may be exploited. An attacker could restart tasks, modify memory, and potentially compromise the integrity and availability of the device. CVSS 3.1 Base Score: 10/10 CVSS 4.0 Base Score: 10/10 CWE: CWE-306: Missing Authentication for Critical Function Known Exploited Vulnerabilities: No Mitigation and Workarounds For customers unable to upgrade to the fixed version, best security practices should be implemented. Revision History Revision Number: 1.0 Date: July 14, 2026 Description: Initial release Glossary CIP Communication: Common Industrial Protocol (CIP) is a communication standard widely used in industrial automation. Known Exploited Vulnerabilities (KEV) Database: An official list of security flaws that are being actively exploited by attackers. Denial of Service (DoS): An attack that disrupts normal system operation by overwhelming it with requests. Get the Latest Product Security Information Visit the Rockwell Automation Security Advisory page: - Subscribe to product security alerts - View the current list of Rockwell Automation security advisories - Report potential security issues in Rockwell Automation products - Learn more about the vulnerability policy Support If you have any questions regarding the aforementioned security issues and their mitigation, please contact TechConnect. For more information, visit Contact Us If you have any questions regarding this disclosure, please contact PSIRT. Email: rsecque@ra.rockwell.com Legal Disclaimer Rockwell Automation does not guarantee the integrity, timeliness, or accuracy of any data on this website. Furthermore, all information is provided to users "as is." Under no circumstances shall Rockwell Automation be liable for any type of damage, including but not limited to direct, indirect, incidental, consequential, loss of profit, or damages, even if Rockwell Automation has been advised of the possibility of such damages. Rockwell Automation expressly disclaims all warranties, whether express or implied, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement. Please note that some jurisdictions do not allow the exclusion of implied warranties, so this disclaimer may not apply to you.

Goal Reached Thanks to every supporter — we hit 100%!

Rockwell Automation 1715 Redundant I/O CVE-2026-10577 Access Control Vulnerability