CISA advisories cover four Rockwell Automation vulnerabilities across 1756-ENBT, ControlFLASH, and ArmorStart LT

On 2026-09-03, CISA published advisories for four Rockwell Automation vulnerabilities: CVE-2025-10478 (CVSS 7.5) DoS in the 1756-ENBT EtherNet/IP bridge, CVE-2026-12663 (CVSS 7.3) local code execution in ControlFLASH V15.07 and earlier, and CVE-2026-19471…

CISA released three Rockwell Automation advisories dated 2026-09-03, including a republication of Rockwell's own advisory, covering four CVEs across three products. (1) CVE-2025-10478 (CVSS 7.5, CWE-754) affects all versions of the 1756-ENBT ControlLogix EtherNet/IP bridge: a crafted CIP packet can crash the module, which requires a manual restart to recover; CISA recommends minimizing network exposure and placing devices behind firewalls. Affected sectors include critical manufacturing, food and agriculture, transportation systems, and water. (2) CVE-2026-12663 (CVSS 7.3) affects ControlFLASH V15.07 and earlier, where the installer grants the Everyone group write permissions on the installation directory, letting a local attacker plant malicious code that executes at the logged-in user's privilege level; the issue is local-only and not remotely exploitable, and affects manufacturing, energy, and water sectors. (3) CVE-2026-19471 (CVSS 7.3) and CVE-2026-19472 (CVSS 7.5) affect the embedded web server of ArmorStart LT v2.001 and earlier: multiple stored cross-site scripting flaws caused by unsanitized input stored server-side, and a denial-of-service triggered by a crafted HTTP PUT request that exhausts web server resources; the fix is updating beyond v2.001 and limiting device internet exposure. No public exploitation has been reported to CISA for any of the four vulnerabilities. The reports do not state fixed versions for the 1756-ENBT or ControlFLASH issues.