CVE-2026-9653
HighCVSS 8.7Summary
A denial-of-service vulnerability in 1756-EN2, EN3, and ENBT communication modules stems from improper validation of CIP Implicit Connection packets. An attacker on the network can send crafted packets to continuously disrupt device connections, which recover immediately afterward.
Risk Assessment
The risk involves intermittent unavailability of control devices, potentially disrupting production or automation processes, though failures are short-lived and self-healing.
Recommendation
Update module firmware to the latest version and segment the ICS network to restrict access to vulnerable devices.
Related vulnerabilities
- CVE-2026-19117Critical
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.
- CVE-2026-66786Critical
In Submariner's cert-auth mode, connection configuration is built from unvalidated free-form strings from the CRD. A malicious cluster can publish a CableName with newlines and ipsec.conf directives, allowing injection of arbitrary configuration or command execution via leftupdown hooks, leading to remote code execution as root on the gateway node.
- CVE-2026-53671Critical
In the PREVAIL eBPF verifier before version 0.2.4, the abstract transformer treats writes through a T_CTX-typed base register as a silent no-op. An attacker can craft an eBPF program that overwrites a context field, reloads it as T_PACKET, and dereferences an attacker-controlled address, and PREVAIL will report the program as safe.
- CVE-2026-53670Critical
In the PREVAIL eBPF verifier before version 0.2.4, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset. Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime.
- CVE-2026-53649Critical
Joro before version 1.1.1 in default proxy mode exposes a local API on 127.0.0.1:9090 with no authentication and wildcard CORS. A malicious website can reach privileged endpoints, including uploading a native plugin and triggering a restart, leading to unauthenticated remote code execution as the operator's user.
- CVE-2026-20279Critical
A vulnerability in Cisco IOS XR Software relates to improper access control issues (CWE-284). It was discovered during an internal security review and addressed in software hardening releases.
- CVE-2026-20274Critical
A vulnerability in Cisco IOS XR Software relates to improper resource control issues (CWE-664). It was discovered during an internal security review and addressed in software hardening releases.
- CVE-2026-20212Critical
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches allows an unauthenticated remote attacker to execute code with root privileges. TCP ports 43210 and 43211 are accessible in the default L3 VRF, and crafted input can lead to code execution or crash of the S1HAL process causing device reload.
- CVE-2026-53611Critical
Looking Glass prior to version 1.3.5 contains an OS Command Injection vulnerability resulting from an unanchored regular expression in the input validation layer. This issue has been patched in version 1.3.5.
- CVE-2026-82955Critical
In the current development version of Eclipse aeriOS, the KrakenD instance in the API Gateway had disable_jwk_security hard-coded to true, disabling TLS certificate verification when retrieving JWKS. This could allow an attacker to intercept communication and provide a malicious JWKS, compromising token validation. The issue has been fixed by making the parameter configurable and defaulting to false.
Original NVD description (English source)
A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt device connections, though device connections will recover immediately after.