CVE-2026-10573: Rockwell Automation 1734 POINT I/O DoS — Detection and Hardening

CISA has released advisory ICSA-26-202-09 regarding a critical denial-of-service (DoS) vulnerability (CVE-2026-10573) affecting Rockwell Automation 1734 POINT I/O modules. With a CVSS v3 score of 7.5, this vulnerability poses a significant risk to the Critical Manufacturing sector. An unauthenticated attacker can send specially crafted Common Industrial Protocol (CIP) messages to the device, triggering a resource allocation error that forces the module into a faulted state.

For operational technology (OT) environments, availability is paramount. A DoS condition on an I/O module can halt production lines, cause safety system failures, and result in significant financial loss. Defenders must act immediately to identify affected assets and enforce strict network segmentation.

Technical Analysis

Affected Product: Rockwell Automation 1734 POINT I/O Affected Version: 3.023 CVE Identifier: CVE-2026-10573 CVSS Score: 7.5 (High) Vulnerability Type: CWE-770 (Allocation of Resources Without Limits or Throttling)

Mechanism of Attack: The vulnerability arises from the improper handling of crafted CIP messages. Rockwell Automation utilizes CIP as the transport layer for ControlLogix and CompactLogix communications. The 1734 POINT I/O module fails to properly limit resource allocation when processing these specific message structures.

Upon receiving a malicious packet, the module exhausts available resources and transitions to a "faulted" state. In this state, the module ceases to process I/O data, effectively severing the connection between the physical sensors/actuators and the PLC controller. Recovery typically requires manual intervention, such as a power cycle or a reset command via the engineering software, prolonging the downtime.

Exploitation Status: As of the advisory release, CISA has identified this as a security issue requiring immediate attention. While active exploitation in the wild has not been explicitly confirmed in the initial release, the simplicity of the attack (sending a packet over the network) makes it a high-risk candidate for automated scanning and disruption by commodity threat actors or disgruntled insiders.

Detection & Response

Detecting this vulnerability requires a focus on network anomalies rather than host-based telemetry, as standard EDR agents do not run on PLCs. Defenders should monitor for unusual CIP traffic patterns targeting the I/O modules on TCP port 44818 (the standard port for CIP explicit messaging).

SIGMA Rules

The following rules are designed to detect potential reconnaissance (scanning) or exploitation attempts against CIP-enabled devices on your network.

---
title: Potential CIP Protocol Scanning or Flood
id: 12a34b56-c78d-90e1-f23a-45b6789cde01
status: experimental
description: Detects scanning or flooding activity targeting Rockwell CIP port (44818) which could indicate exploitation attempts of CVE-2026-10573.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-09
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 44818
    Protocol: tcp
  filter:
    SourceIp|startswith:
      - '192.168.' # Exclude local management subnets, adjust as needed
  condition: selection and not filter | count(SourceIp) > 100
falsepositives:
  - Legitimate heavy polling from HMIs during startup
level: high
---
title: Suspicious Process Execution on Engineering Workstation
id: 23b45c67-d89e-01f2-g34b-56c7890def12
status: experimental
description: Detects execution of common network scanning tools on OT Engineering Workstations often used prior to ICS exploitation.
references:
  - https://attack.mitre.org/techniques/T1595/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1595
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\nmap.exe'
      - '\masscan.exe'
      - '\netcat.exe'
      - '\nc.exe'
falsepositives:
  - Authorized network troubleshooting by admins
level: medium

KQL (Microsoft Sentinel / Defender)

This KQL query hunts for high-volume connections to the CIP port, indicative of a fuzzing attempt or a flood attack designed to trigger the DoS condition.

// Hunt for anomalous traffic to CIP Port 44818 (Rockwell Automation)
// Ingest source: Firewall or IDS logs via CommonSecurityLog or DeviceNetworkEvents
DeviceNetworkEvents
| where RemotePort == 44818
| summarize Count = count() by DeviceName, RemoteIP, bin(TimeGenerated, 1m)
| where Count > 100 // Threshold tuning required based on environment polling rates
| order by Count desc
// Note: Exclude known HMI/SCADA server IPs from baseline analysis

Velociraptor VQL

Use this artifact on Windows Engineering Workstations to detect if an adversary or insider is running network scanning tools that could be used to identify vulnerable I/O modules.

-- Hunt for network scanning tools on Engineering Workstations
SELECT Sys.EventTime, Sys.Username, Name, CommandLine, Exe
FROM pslist()
WHERE Name =~ "nmap"
   OR Name =~ "masscan"
   OR Name =~ "netcat"
   OR CommandLine =~ "44818"

Remediation Script

Since a patch may not be immediately available or applicable without downtime, the primary mitigation is network segmentation. This PowerShell script helps audit and restrict access to CIP ports on a Windows-based jump server or firewall sitting at the IT/OT boundary.

# Script to audit and restrict access to CIP Ports on Windows-based Firewall (Edge protection)
# Usage: Run on the Jump Server or Firewall controlling OT traffic

function Block-CIPAccess {
    param (
        [string]$RemoteSubnet, # The subnet to block (e.g., "10.0.0.0/24")
        [string]$RuleName = "Block-Unauthorized-CIP-Traffic"
    )

    # Check if rule exists
    $existingRule = Get-NetFirewallRule -DisplayName $RuleName -ErrorAction SilentlyContinue

    if (-not $existingRule) {
        New-NetFirewallRule -DisplayName $RuleName `
                            -Direction Outbound `
                            -Action Block `
                            -RemoteAddress $RemoteSubnet `
                            -Protocol TCP `
                            -LocalPort 44818 `
                            -Profile Any `
                            -Description "Block unauthorized CIP traffic to mitigate CVE-2026-10573 risk"
        Write-Output "Firewall rule '$RuleName' created for subnet $RemoteSubnet."
    } else {
        Write-Output "Firewall rule '$RuleName' already exists."
    }
}

# Example: Block traffic from a non-critical office subnet to the PLC network
# Block-CIPAccess -RemoteSubnet "192.168.100.0/24"

Remediation

To address CVE-2026-10573, Security Arsenal recommends the following immediate actions:

1. Apply Firmware Updates: Monitor the Rockwell Automation Knowledgebase for a firmware release that addresses version 3.023. Update to the latest secure version immediately upon release and validation in a test environment.
2. Network Segmentation:
   • Restrict TCP port 44818 (CIP) traffic to only originate from known, trusted IP addresses (e.g., the PLC controller and Engineering Workstations).
   • Block all inbound access to the I/O modules from the Internet and untrusted corporate networks.
3. Monitor for Faults: Configure your HMI/SCADA system to generate immediate alerts when a 1734 POINT I/O module enters a "Major Fault" or "Run Mode Fault" state.
4. Review CISA Advisory: Refer to ICSA-26-202-09 for the latest vendor mitigations and specific configuration recommendations.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub