Rockwell Automation has disclosed a high-severity denial-of-service vulnerability in its 432ES-IG3 GuardLink EtherNet/IP safety module that requires a manual power cycle to recover, and federal authorities are urging immediate action. The flaw, tracked as CVE-2025-9368, can be triggered remotely without authentication, knocking the device offline and potentially halting manufacturing lines until an operator physically restarts the hardware.
Rockwell released corrected firmware — version 2.001.9 — and CISA republished the vendor advisory on January 13, 2026, calling on organizations to patch or isolate affected systems. No public exploitation has been reported, but the low attack complexity and high availability impact make it a priority for industrial sites worldwide.
What Changed: A Network-Based Knockout Punch
The vulnerability lies in the GuardLink EtherNet/IP interface on the 432ES-IG3 Series A module running firmware version 1.001. During internal testing, Rockwell discovered that the device does not properly throttle network-facing resources, falling under CWE-770 — allocation of resources without limits or throttling. An attacker on the same network segment can send crafted traffic that exhausts the module’s ability to process legitimate safety communications, causing a complete denial of service.
The CVSS v3.1 base score sits at 7.5 (High), while version 4.0 registers 8.7 (High). The vector string — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — confirms the vulnerability is exploitable over the network with no authentication or user interaction needed, and it carries zero confidentiality or integrity impact. Recovery requires a manual power cycle; a software reboot or remote command won’t restore operation.
Rockwell’s advisory SD1764 identifies the fixed firmware as 2.001.9 or later. CISA’s accompanying alert adds no new technical details but reinforces standard ICS mitigation strategies.
Why a Manual Reboot Matters: Real-World Consequences
Industrial safety modules aren’t office printers. The 432ES-IG3 monitors up to 96 GuardLink safety devices — light curtains, e-stop buttons, interlock switches — and relays status to a safety controller over CIP Safety EtherNet/IP. Knocking it offline doesn’t just flash a diagnostic LED; it can force safety-rated equipment into a fault state, trigger emergency stops, or leave operators uncertain about safety status.
“Manual power cycle” means exactly that: someone must walk over to the cabinet, find the module, and kill the power. In a cavernous assembly plant or a remote pumping station, that simple task can take minutes to hours. Facilities running lights-out shifts or with minimal on-site staff face extended downtime. Automated restart scripts, remote management tools, and soft resets are useless.
For 24/7 operations, the realistic downtime window balloons. A single well-placed DoS attack could stop an entire production line, costing thousands per minute in lost output.
How We Got Here: A Pattern of Network-Reachable Safety Gaps
Industrial control systems have long lagged behind IT in patching cadence and network segmentation. The 432ES-IG3 is typical of modern smart sensors that combine safety functions with Ethernet connectivity — a convenience that also expands the attack surface. As factories adopt more networked devices, vulnerabilities like CVE-2025-9368 become harder to ignore.
Rockwell’s internal discovery is a responsible disclosure win; the company assigned a CVE and released a fix before any known exploitation. Yet the timeline from discovery to full deployment in industrial settings can stretch for months. Many plants hesitate to touch safety-certified firmware without lengthy lab validation and scheduled downtime, leaving devices exposed.
CISA’s re-publication and the lack of a workaround — no temporary config tweak or software shim — underscore the urgency. Past ICS advisories have shown that even “availability-only” flaws can be leveraged by ransomware actors or disgruntled insiders to cripple production.
What to Do Now: Patch, Segment, Prepare for Manual Recovery
If you have 432ES-IG3 modules in your environment, move on these actions immediately:
-
Inventory and Assess Exposure
Identify every GuardLink interface in your asset management system or via engineering workstations. Note firmware revisions and document which ones sit on networks reachable from the plant floor, VPNs, or (worst case) the internet. -
Apply the Vendor Patch
Download firmware 2.001.9 from Rockwell’s Trust Center or product compatibility page. Test the update in a non-production environment first, exercising safety functions to confirm no regressions. Schedule production take-offs or maintenance windows to deploy. -
Compensating Controls Until You Can Patch
- Isolate vulnerable modules behind firewalls with strict ACLs — only allow traffic from known management and controller hosts.
- Disable any unnecessary remote access or cloud connectivity that touches the GuardLink VLAN.
- Harden VPN endpoints: enforce multi-factor authentication and restrict which endpoints can see control networks. -
Update Incident Response Plans
Document the manual power-cycle procedure. Ensure on-site personnel know where each module is and who to call for after-hours recovery. If you run remote sites without staff, pre-position spares or arrange for dispatch. -
Monitor for Signs of Attack
Watch for sudden communication drops, controller alarms reporting GuardLink status loss, or unusual spikes in CIP traffic. Correlate network flow logs with device telemetry; even without a public exploit, probing activity may precede an actual attempt.
Looking Ahead: The Patch Is Only Half the Battle
Rockwell’s fix is straightforward in a lab, but industrial reality is messier. Expect weeks to months before all devices are updated, especially in sectors with long maintenance cycles. In the interim, network segmentation will bear most of the defensive load.
This is not the last safety-device vulnerability you’ll see. As OT and IT converge, organizations must treat safety-module firmware like any critical IT patch — with urgency, testing discipline, and a plan for when the network fails. The absence of a software-only workaround is a loud reminder that physical process integration still carries physical constraints.
The path forward is clear: patch now where you can, isolate where you can’t, and rehearse your manual recovery. In a world where a crafted packet can force a nighttime walk to the electrical panel, preparedness beats luck every time.