Rockwell Flex 5000 Adapter Double Free (CVE-2026-12659): DoS Against Distributed I/O

Executive Summary

CVE-2026-12659 is a double free condition in the Rockwell Automation Flex 5000 Adapter firmware version 6.011 that a network-reachable attacker can trigger to cause a denial-of-service condition on the adapter. The physical consequence is loss of the distributed I/O rack the adapter fronts, which severs the controller from the field devices behind it and can halt or freeze the controlled process.

Technical Exposure Breakdown

The vulnerable component is the Flex 5000 Adapter itself, the module that terminates the EtherNet/IP connection and bridges it to the local backplane of distributed I/O modules. A double free is a memory corruption class where the same heap allocation is released twice. In a memory-managed embedded stack this corrupts the allocator metadata. The realistic outcome on a constrained industrial controller is a watchdog reset, a faulted module state, or a hard hang, rather than reliable arbitrary code execution. The advisory scores this as a v3 7.5 with an availability-only impact, which is consistent with a DoS rather than a code execution primitive.

The attack vector is the network. EtherNet/IP and the CIP object model expose the adapter to crafted requests over TCP port 44818 and UDP 2222 for implicit I/O traffic. An attacker who can reach the adapter at the packet level, whether from a compromised engineering workstation, a flat cell network, or a misrouted VLAN, can send the malformed sequence that drives the free-then-free-again path. No authentication is assumed in the scoring, and CIP historically has weak or absent authentication on the wire, so the practical precondition is network reachability alone.

Note the second point plainly. Do not attempt to confirm this by scanning the adapter with generic vulnerability tooling. Active probing of the CIP stack on a live Flex 5000 rack can itself induce the fault this advisory describes. Discovery of affected assets should be done from passive traffic capture and from asset inventory, not from an authenticated or unauthenticated scan against production I/O.

OT Impact and Compliance Risk

The physical failure mode is loss of view and loss of control for every I/O point on the affected adapter. Analog and discrete field signals stop updating, the owning controller sees a connection fault, and depending on program logic the process either holds last state, drives to a configured safe state, or trips. On a continuous process this is an unplanned outage. On any line where the I/O is safety-adjacent, a nuisance trip carries its own operational and mechanical risk.

For compliance, IEC 62443-3-3 is directly implicated through SR 7.1 and SR 7.2, the resource availability and DoS protection requirements, and through the zone and conduit segmentation model in 62443-3-2. For NERC CIP-regulated environments, an EtherNet/IP-reachable adapter inside an Electronic Security Perimeter that can be knocked offline is a CIP-005 and CIP-007 concern, both for perimeter controls and for the security patch management timeline once a fix is available. TSA pipeline operators under SD-02C should map this to their segmentation and continuous monitoring objectives, and water utilities under AWIA 2018 should treat any distributed I/O DoS as a risk-and-resilience finding.

Compensating Controls

Firmware remediation to the fixed version is the endpoint, but the network is the near-term control surface. First, enforce zone and conduit boundaries so that only the specific controllers and engineering hosts that legitimately talk CIP to the adapter can reach ports 44818 and 2222. Deny all other CIP-capable sources at the conduit firewall or managed switch ACL. Second, deploy passive protocol monitoring. A Suricata rule concept here watches for anomalous CIP request patterns to the adapter, specifically malformed or rapid connection open and close sequences and unexpected CIP service codes from sources outside the authorized controller set, and alerts rather than blocks inline where inline enforcement risks the very availability you are protecting.

The virtual patch approach is to place a protocol-aware boundary in front of the adapter that normalizes or drops the crafted CIP sequences before they reach the memory-corruptible stack, buying time until firmware can be staged during a maintenance window. Do not schedule firmware updates against live production I/O outside of a controlled outage, because the update process itself faults the module.

BreachSpider Intel

BreachSpider tracks Rockwell EtherNet/IP exposure and CIP-borne DoS activity across OT estates so operators can prioritize remediation against real reachability rather than raw CVSS.