CVE-2025-9178
BaseFortify
Publication date: 2025-10-14
Last updated on: 2025-10-14
Assigner: Rockwell Automation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rockwell_automation | 1715_aentr_ethernet/ip_adapter | 3.011 |
| rockwell_automation | 1715_aentr_ethernet/ip_adapter | 3.003 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-9178 is a denial-of-service (DoS) vulnerability affecting the Rockwell Automation 1715 EtherNet/IP Adapter. It is caused by crafted payloads sent through CIP (Common Industrial Protocol) communication, which can result in loss of CIP communication with the adapter. To recover from this issue, a device restart is required. The vulnerability is classified under CWE-787 (Out-of-bounds Write) and affects versions prior to 3.011 of the adapter's software. [1]
How can this vulnerability impact me? :
This vulnerability can cause a denial-of-service condition by disrupting CIP communication with the 1715 EtherNet/IP Adapter. This disruption means that the adapter will stop communicating over CIP until it is restarted, potentially causing downtime or loss of communication in industrial control systems relying on this device. Recovery requires a device restart, and no workaround is available other than upgrading to a fixed software version. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability can be detected by monitoring for loss of CIP communication with the 1715 EtherNet/IP Adapter caused by crafted CIP payloads. Specific detection commands are not provided in the available resources. Monitoring network traffic for unusual or crafted CIP payloads targeting the adapter may help identify exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading the 1715 EtherNet/IP Adapter software to version 3.011 or later, where the vulnerability is corrected. No workarounds are available. If upgrading is not immediately possible, follow Rockwell Automation's security best practices and consider contacting Rockwell Automation TechConnect for support. A device restart is required to recover from an attack. [1]