Rockwell Automation RSLinx Classic: 4 CVEs, High 8.6
Summary
CISA reports 4 vulnerabilities in Rockwell Automation RSLinx Classic. Weakness types: Integer Overflow or Wraparound, Integer Underflow (Wrap or Wraparound), Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'). Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the affected product. Highest CVSS v3 score: 8.6 (High), exploitable over the network.
At a glance
- Vendor
- Rockwell Automation
- Products
- RSLinx Classic
- CVEs
- CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625
- Highest CVSS v3
- 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-9621 | Integer Overflow or Wraparound | 8.6 | – | No | A denial-of-service security issue exists within RSLinx Classic. The security issue stems from improper handling of a malformed packet. A crafted CIP packet can cause the RSLinx Classic service to crash, requiring a restart of the service to recover. |
| CVE-2026-9622 | Integer Underflow (Wrap or Wraparound) | 8.6 | – | No | A denial-of-service security issue exists within RSLinx Classic. A crafted CIP packet targeting the Forward Close service can cause the RSLinx Classic service to crash, requiring a restart of the service to recover. |
| CVE-2026-9624 | Integer Underflow (Wrap or Wraparound) | 7.5 | – | No | A denial-of-service security issue exists within RSLinx Classic. A crafted CIP packet can cause the RSLinx Classic service to crash due to insufficient data length validation, requiring a restart of the service to recover. |
| CVE-2026-9625 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 7.5 | – | No | A denial-of-service security issue exists within RSLinx Classic. A crafted CIP packet with an oversized embedded message request can cause the RSLinx Classic service to crash, requiring a restart of the service to recover. |
Affected products (1)
- Rockwell Automation RSLinx Classic: <=4.50
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Rockwell Automation has corrected the vulnerabilities in RSLinx Classic version 4.60.
- Mitigation: Users using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight. link
- Mitigation: For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.