CVE-2026-9653CWE-354

1756-EN2, 1756-EN3, and 1756-ENBT - Denial of Service via CIP Connection ID

High · published July 14, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt device connections, though device connections will recover immediately after.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00231 · 13.2th percentile
Weakness
CWE-354 · Improper Validation of Integrity Check Value
Published
2026-07-14T15:00Z
EPSS history
Timeline
  • 14 JUL 15:00Z
    1756-EN2, 1756-EN3, and 1756-ENBT - Denial of Service via CIP Connection ID
    cvelistv5