Rockwell Automation 1732E ArmorBlock I/O: Denial of service via network storm traffic
Summary
Rockwell Automation 1732E ArmorBlock I/O modules up to and including firmware 3.012 mishandle network storm traffic. An attacker who can reach the device over the network, without credentials or user interaction, can interrupt communication, cause device faults and affect open TCP and UDP ports. A power cycle is required to restore the device to normal operation. The same advisory also covers CVE-2026-12655, which allows an unauthenticated attacker to change the web server password and should be patched at the same time.
Affected
- 1732E ArmorBlock I/O, firmware 0 to 3.012 (CNA range: up to and including 3.012)
- Catalog numbers named in the official advisory: 1732E-IB16M12R, 1732E-OB16M12R, 1732E-16CFGM12R, 1732E-IB16M12DR, 1732E-OB16M12DR
- Unofficial mirror lists further catalog numbers; verify the official advisory for each device
Fixed in
- Firmware 3.013 or later
Workaround
- Unknown. Rockwell marks the advisory as corrected and documents no specific interim mitigation; only its general security best practices are referenced for devices that cannot be upgraded.
Exploitation
- Not listed as known exploited by Rockwell; CISA KEV not checked directly.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- VulDB states no exploit is available; no public proof-of-concept known.
- Rockwell reports the issue was found internally during routine testing; no attacks in the wild found.
Our recommendation
- Identify all 1732E ArmorBlock I/O devices and their exact catalog number and firmware version.
- Update affected devices to firmware 3.013 or later in the next maintenance window, together with the fix for CVE-2026-12655.
- Until patched, segment the OT network, restrict access to the web server and control traffic, and remove any port forwarding or remote access to the plant network.
- Monitor for network storms, unexpected device faults and communication loss.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Rockwell Automation Security Advisory SD1801 www.rockwellautomation.com
- Rockwell Automation Security Advisories (overview) www.rockwellautomation.com
- Vulners: CVE-2026-12656 (CNA data) vulners.com
- VulDB: CVE-2026-12656 vuldb.com
- PSIRT: CVE-2026-12656 psirt.com
- CyberInsider: Rockwell patches ArmorBlock I/O module vulnerabilities cyberinsider.co.uk
- Unofficial mirror of advisory (cve.imfht.com) cve.imfht.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:28.
Original description (NVD)
A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to its normal state.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.