Loading vulnerability…
Unauthenticated Debug CLI Access in Rockwell Automation 1715-AENTR EtherNet/IP Adapter
CVE-2026-10577 is a critical access control vulnerability in the Rockwell Automation 1715-AENTR EtherNet/IP Adapter, also described as the 1715 EtherNet/IP Communications Module. The issue arises because a network-accessible debug port does not enforce authentication or proper privilege controls for critical debug functionality. As a result, a remote attacker can access intrusive command-line interface functionality without authentication. Available functionality includes actions such as reading or deleting files, stopping tasks, modifying memory, and changing I/O states. The vulnerability affects firmware version 3.003 and earlier and is fixed in firmware version 3.011.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise confidentiality, integrity, and availability of the affected industrial device. An unauthenticated remote attacker may obtain access to sensitive device data, delete files, interrupt device operations by stopping tasks, alter memory contents, and manipulate I/O states. In industrial environments, these capabilities can disrupt control processes and undermine the reliability and safety assumptions of high-availability redundant I/O deployments.
If you can’t patch tonight, do this now.
If immediate remediation is not possible, reduce exposure of the debug functionality by segmenting OT networks, restricting network access to the affected module, and blocking unnecessary ports at network boundaries. Additional defensive measures include disabling or otherwise securing the debug port where supported and enforcing strict access controls around management and debug access paths.
Patch, then assume compromise.
Upgrade affected 1715-AENTR devices to firmware version 3.011, which fixes the vulnerability. Prioritize identification of devices running firmware 3.003 and earlier and validate upgrade procedures in accordance with operational requirements for industrial environments.
No public exploits tracked yet. Mallory keeps watching.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.