As reported by CISA in advisory ICSA-26-202-09, a high-severity vulnerability has been disclosed affecting Rockwell Automation's 1734 POINT I/O modules — a widely deployed component in industrial control environments across critical manufacturing and process automation sectors worldwide.
Vulnerability At a Glance
- CVE ID
- CVE-2026-10573
- CVSS v3 Score
- 7.5 — High
- Affected Vendor
- Rockwell Automation
- Affected Product
- 1734 POINT I/O, firmware version 3.023
- Vulnerability Class
- CWE-770: Allocation of Resources Without Limits or Throttling
- Impact
- Denial-of-Service — module enters a faulted state; manual restart required to recover
- Active Exploitation
- Not confirmed at time of advisory
- Patch Available
- Consult Rockwell Automation's official security advisory and product lifecycle guidance
Why This Matters to OT Security Teams
The 1734 POINT I/O family is a staple of distributed I/O architectures in manufacturing, energy, water treatment, and automotive production environments. These modules bridge the gap between physical field devices — sensors, actuators, valves — and the industrial network, making them operationally indispensable. When one faults, it doesn't just drop a data feed: it can halt production lines, trigger safety interlocks, or create dangerous blind spots in process monitoring.
What makes CVE-2026-10573 particularly concerning is the attack mechanism. Exploitation requires only the ability to send crafted CIP (Common Industrial Protocol) messages to the affected module. CIP is the native communication protocol across Rockwell's EtherNet/IP ecosystem, meaning any device on the same industrial network segment — or any attacker who has pivoted from IT to OT — has the primitives needed to trigger this fault condition. The barrier to exploitation is low; recovery, however, requires physical or administrative intervention to restart the device.
A faulted I/O module that requires manual restart is not a minor inconvenience in a manufacturing context — it is a production outage with measurable financial and safety consequences.
Who Is Most Exposed?
Risk is highest for organizations that:
Shield53 Recommendations
Immediate Actions
- Inventory: Identify all 1734 POINT I/O modules on your network and confirm firmware versions. Focus on any running version 3.023.
- Patch Review: Check Rockwell Automation's Product Security Incident Response Team (PSIRT) portal immediately for available firmware updates or official mitigations.
- Network Isolation: If patching is not immediately feasible, restrict EtherNet/IP (TCP/UDP 44818, UDP 2222) access to POINT I/O modules using industrial firewalls or managed switch ACLs. Only authorized controllers and engineering stations should be able to initiate CIP sessions to I/O adapters.
- Monitor CIP Traffic: Deploy OT-aware network detection (e.g., Claroty, Dragos, Nozomi) with rules to flag anomalous CIP message rates or malformed CIP packets targeting I/O modules.
- Restart Procedures: Ensure operations and maintenance teams are aware of the fault condition and that documented restart procedures are readily accessible — reducing mean time to recovery if exploitation occurs before patching is complete.
Longer-Term Posture Improvements
- Implement IEC 62443-compliant zone and conduit segmentation between IT and OT networks.
- Apply the principle of least privilege to all CIP communication paths — not every device needs to talk to every I/O adapter.
- Establish a formal OT vulnerability management process aligned with CISA's ICS advisory feed to reduce dwell time between disclosure and remediation.
Denial-of-service vulnerabilities in ICS components are sometimes dismissed as lower-priority compared to remote code execution flaws. That calculus is wrong in operational technology environments. Availability is the primary security property in industrial control — and any flaw that lets an adversary halt a production asset on demand deserves urgent, structured attention.
