As reported by CISA in advisory ICSA-26-246-05, Rockwell Automation has disclosed a denial-of-service vulnerability (CVE-2025-10478) affecting every version of its 1756-ENBT ControlLogix EtherNet/IP bridge module. The flaw allows an unauthenticated attacker on the network to send a crafted CIP packet that crashes the module, requiring a manual restart to restore communications. There is no firmware patch. The only vendor-authorized remediation is upgrading to the 1756-EN2T or 1756-EN4TR replacement modules.
This advisory deserves more attention than a typical single-CVE ICS notice, and here is why: it targets a legacy bridge component that remains deployed in tens of thousands of installed ControlLogix chassis across critical manufacturing, food and agriculture, transportation, and water/wastewater facilities. The 1756-ENBT is a workhorse communication module — when it goes down, the controller loses its Ethernet connectivity to HMIs, SCADA, engineering workstations, and peer controllers. A single crafted packet can take a production line or process loop offline indefinitely until someone physically cycles power or replaces the card.
Vulnerability Details
| Field | Detail |
|---|---|
| CVE | CVE-2025-10478 |
| CVSS v3.1 | 7.5 High — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CVSS v4.0 | 8.7 High |
| CWE | CWE-754: Improper Check for Unusual or Exceptional Conditions |
| Affected Product | Rockwell Automation 1756-ENBT module — all versions |
| Vendor | Rockwell Automation |
| Exploitation Observed | Not confirmed in the wild at time of disclosure |
| Patch Available | No — upgrade to 1756-EN2T or 1756-EN4TR required |
| Attack Vector | Network, unauthenticated, single crafted CIP packet |
Why This Matters
The 1756-ENBT is a legacy EtherNet/IP bridge that Rockwell has been phasing out for years, but operational technology environments are slow to modernize. Many sites keep these modules running because they are functionally adequate and swapping a chassis communication card requires a planned outage. The absence of any firmware fix converts this from a maintenance concern into a security-driven replacement project — and that is a hard conversation for plant managers who control shutdown windows.
The CVSS v4.0 score of 8.7, notably higher than the v3.1 score of 7.5, reflects what OT security practitioners already know: availability impacts in industrial settings carry greater real-world consequence than the same impact in an IT context. A crashed email server is an inconvenience. A crashed EtherNet/IP bridge on a water treatment PLC is a regulatory and safety event.
Who Is at Risk
- Facilities running ControlLogix chassis with 1756-ENBT modules exposed on routable or semi-routable networks.
- Critical manufacturing, food and beverage, transportation, and water/wastewater sectors — all explicitly named by CISA.
- Sites where the ENBT module sits on a flat network shared with HMIs, engineering workstations, or third-party vendor connections.
- Organizations that have not yet segmented EtherNet/IP traffic from general-purpose corporate or guest networks.
Immediate Actions
- Inventory: Audit all ControlLogix chassis for 1756-ENBT modules using Rockwell's FactoryTalk Asset Centre or manual inspection. Document module revision, chassis location, and network attachment point.
- Segment: Ensure ENBT modules are behind an OT firewall or Purdue Level 2/3 segmentation appliance. Restrict EtherNet/IP (TCP 44818, UDP 2222) to explicitly listed peers only. No unauthenticated CIP traffic should be reachable from corporate or guest networks.
- Detect: Deploy IDS signatures for anomalous or malformed CIP packets. Monitor for unexpected TCP 44818 connections from non-authorized hosts. Alert on module restart events in controller logs.
- Plan replacement: Prioritize ENBT replacement with 1756-EN2T or 1756-EN4TR in the next planned maintenance window. For sites with many modules, rank by exposure: internet-adjacent or vendor-accessible chassis first.
- Compensating controls: Where immediate replacement is not feasible, enforce strict allow-listing at the switch port level (802.1X or static MAC binding) and disable unused CIP services per Rockwell's hardening guidance.
Shield53 Recommendations
The absence of a firmware patch makes this a lifecycle decision, not a patching task. Treat the 1756-ENBT as end-of-life for security purposes and budget for replacement in your next capital cycle.
