VULNERABILITY INTELLIGENCE
CVE-2026-0647
EPSS probability0.43%
CISA KEVNot currently listed
Published2026-06-16
Last modified2026-10-25
Description
An improper authentication security issue exists within the 1794-AENTR adapter's embedded web server. The vulnerability allows an unauthenticated attacker to change the device's web interface password by sending a crafted HTTP GET request to a specific endpoint, without any prior authentication being required. If exploited, this could lead to unauthorized access, account takeover, and loss of the device’s embedded web server’s availability.
Weakness classification
- PSIRT@rockwellautomation.com: CWE-306