Critical Rockwell FLEX I/O Flaws Enable Unauthenticated Takeover and DoS
Two critical vulnerabilities in Rockwell Automation FLEX I/O EtherNet/IP Adapters expose industrial control systems to unauthenticated password changes and denial-of-service attacks, threatening operational continuity in critical manufacturing environments. CVE-2026-0647 is particularly dangerous because it requires no authentication to change web interface credentials, effectively handing full device control to any attacker with network access. These flaws highlight the systemic risk of deploying OT/ICS devices with weak or absent authentication mechanisms on network-accessible interfaces. In critical infrastructure sectors, even brief loss of availability or unauthorized device control can cascade into physical process disruptions or safety incidents.
Tactical Insight
Immediate Actions
- Apply Rockwell Automation's latest firmware patches or mitigations for CVE-2026-0646 and CVE-2026-0647 as soon as possible.
- Restrict network access to FLEX I/O adapters by placing them behind firewalls or access control lists that block untrusted sources.
- Audit all FLEX I/O web interface accounts to detect any unauthorized password changes that may have already occurred.
Long-Term Improvements
- Implement network segmentation to isolate OT/ICS devices from corporate IT networks and the internet.
- Enforce strong authentication requirements (MFA where supported) on all industrial device management interfaces.
- Maintain a comprehensive, up-to-date inventory of all ICS/OT assets to accelerate patching and vulnerability response cycles.
Detection Measures
- Deploy OT-aware intrusion detection systems (IDS) to monitor EtherNet/IP traffic for anomalous authentication or configuration-change events.
- Enable centralized logging for all administrative actions on industrial adapters and alert on unexpected credential modification attempts.
- Conduct regular vulnerability scans of ICS environments using tools compliant with ICS security standards to identify unpatched devices proactively.