Vulnerability · Published Jun 16, 2026 · Assigned by Rockwell

CVE-2026-0647Rockwell Automation FLEX I/O Dual-port EtherNet/IP Adapters – Multiple Vulnerabilities

High 8.8

In plain English

A high-severity missing authentication in FLEX I/O EtherNet/IP Adapters from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.4%top 62.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An improper authentication security issue exists within the 1794-AENTR adapter's embedded web server. The vulnerability allows an unauthenticated attacker to change the device's web interface password by sending a crafted HTTP GET request to a specific endpoint, without any prior authentication being required. If exploited, this could lead to unauthorized access, account takeover, and loss of the device’s embedded web server’s availability.

Affected products (as reported)

Vendor	Product	Versions
Rockwell Automation	FLEX I/O EtherNet/IP Adapters	2.012

Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1775.html