ICSA-25-226-26: Rockwell Automation FLEX 5000 I/O (Update A)

Summary

Successful exploitation of these vulnerabilities could create a denial-of-service condition. CVE-2025-9041: A security issue exists due to improper handling of CIP Class 32's request when a module is inhibited on the 5094-IF8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection fault (Code 16#0010), and the module cannot recover without a power cycle. CVE-2025-9042: A security issue exists due to improper handling of CIP Class 32's request when a module is inhibited on the 5094-IY8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection fault (Code 16#0010), and the module cannot recover without a power cycle.

Advisory Details CISA ICS CSAF feed

Advisory ID: ICSA-25-226-26
Status: Final · version 2
Initial release: 2025-08-14
Last revised: 2025-09-30 (2 revisions)
Vendor: Rockwell Automation
Critical infrastructure sectors: Chemical, Critical Manufacturing, Energy, Food and Agriculture, Transportation Systems, Water and Wastewater
Deployed: Worldwide
Vendor headquarters: United States

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Credit: Rockwell Automation

Affected products (2)

5094-IF8 — V2.011
5094-IY8 — V2.011

Revision history (2)

2025-09-30 — v2: Revision - Fixed CVE references
2025-08-14 — v1: Initial Publication

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVE	Weakness	CVSS v3	Details
CVE-2025-9041	CWE-20 Improper Input Validation	7.5 High	A security issue exists due to improper handling of CIP Class 32's request when a module is inhibited on the 5094-IF8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection fault (Code 16#0010), and the module cannot recover without a power cycle. Mitigation: Rockwell Automation recommends users upgrade to V2.012 or later. The update can be downloaded from Rockwell Automation's website. ↗ Mitigation: Rockwell Automation also recommends users follow their published Security Best Practices. ↗ Affected, fixed & timeline Affected: 5094-IF8 V2.011
CVE-2025-9042	CWE-20 Improper Input Validation	7.5 High	A security issue exists due to improper handling of CIP Class 32's request when a module is inhibited on the 5094-IY8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection fault (Code 16#0010), and the module cannot recover without a power cycle. Mitigation: Rockwell Automation recommends users upgrade to V2.012 or later. The update can be downloaded from Rockwell Automation's website. ↗ Mitigation: Rockwell Automation also recommends users follow their published Security Best Practices. ↗ Affected, fixed & timeline Affected: 5094-IY8 V2.011

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2025-9041	8.7 High	Rockwell Automation FLEX 5000 I/O A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IF8 device. It causes the module to…
CVE-2025-9042	8.7 High	Rockwell Automation FLEX 5000 I/O A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IY8 device. It causes the module to…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Rockwell 1 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.

CyberzSOC