CVE-2026-9621: RSLinx Classic DoS Vulnerability

CVE-2026-9621 Overview

CVE-2026-9621 is a denial-of-service vulnerability affecting Rockwell Automation RSLinx Classic. The flaw stems from improper handling of a malformed Common Industrial Protocol (CIP) packet. A remote, unauthenticated attacker can send a crafted CIP packet to crash the RSLinx Classic service, requiring a manual restart to restore operation.

The vulnerability is tracked under CWE-190 (Integer Overflow or Wraparound) and impacts availability of industrial control system communications. RSLinx Classic is widely deployed as the communications backbone between Rockwell programmable logic controllers (PLCs) and engineering or Human-Machine Interface (HMI) applications.

Critical Impact
Remote unauthenticated attackers can crash the RSLinx Classic service with a single crafted CIP packet, disrupting operational technology (OT) communications between engineering workstations and industrial controllers.

Affected Products

Rockwell Automation RSLinx Classic (see vendor advisory SD1794 for affected versions)
Systems relying on RSLinx Classic for CIP-based communication with Allen-Bradley PLCs
Engineering workstations and HMI hosts integrated with FactoryTalk services

Discovery Timeline

2026-09-01 - CVE-2026-9621 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-9621

Vulnerability Analysis

The vulnerability resides in the CIP packet parsing logic within RSLinx Classic. When the service receives a specifically malformed CIP packet, an integer overflow condition (CWE-190) leads to improper handling of the packet contents. This causes the RSLinx Classic service process to terminate unexpectedly.

Because RSLinx Classic runs as a persistent Windows service acting as a gateway between Rockwell PLCs and higher-level applications, a crash halts all dependent industrial communications. Recovery requires an operator to restart the service, extending the outage window in OT environments where uptime is essential.

The attack requires no authentication, no user interaction, and can be delivered across the network. Exploitation affects availability only; the vulnerability does not provide code execution or information disclosure based on the vendor description.

Root Cause

The root cause is an integer overflow in the routine that processes incoming CIP packet fields. Length or size values in the malformed packet are not validated before being used in arithmetic operations, producing a wraparound that leads to incorrect memory handling and a service crash.

Attack Vector

An attacker with network reachability to the RSLinx Classic service port sends a crafted CIP packet over Ethernet/IP. RSLinx typically listens on TCP/UDP port 44818 for EtherNet/IP CIP communications. No credentials or user interaction are required, making the vulnerability trivially exploitable on flat OT networks.

The vulnerability mechanism is described in prose only, as no verified proof-of-concept code has been published. Refer to the Rockwell Automation Security Advisory SD1794 for authoritative technical details.

Detection Methods for CVE-2026-9621

Indicators of Compromise

Unexpected termination of the RSLinx Classic Windows service (event log entries for service crash or restart)
Loss of communication between engineering workstations, HMIs, and downstream PLCs
Inbound CIP traffic to TCP/UDP port 44818 from unexpected or non-engineering hosts
Application or Windows Error Reporting entries referencing RsvcHost.exe or related RSLinx binaries

Detection Strategies

Monitor Windows Service Control Manager events (Event ID 7031, 7034) for RSLinx Classic service failures
Deploy OT-aware network intrusion detection signatures for malformed CIP packets targeting port 44818
Correlate PLC communication timeouts across HMI and SCADA systems with RSLinx host events

Monitoring Recommendations

Ingest Windows service and application crash logs from RSLinx hosts into a centralized SIEM for correlation
Baseline expected CIP traffic sources and alert on new or unauthorized peers initiating EtherNet/IP sessions
Track service restart frequency on RSLinx hosts as a leading indicator of exploitation attempts

How to Mitigate CVE-2026-9621

Immediate Actions Required

Apply the patched version of RSLinx Classic identified in Rockwell Automation advisory SD1794
Restrict network access to TCP/UDP port 44818 on RSLinx hosts using host and network firewalls
Inventory all engineering workstations and servers running RSLinx Classic to confirm patch coverage

Patch Information

Rockwell Automation has published security advisory SD1794 covering CVE-2026-9621. Consult the Rockwell Automation Security Advisory for the fixed version, product identifiers, and update instructions. Access to the advisory requires a Rockwell Automation account.

Workarounds

Segment RSLinx Classic hosts onto a dedicated OT VLAN, permitting CIP traffic only from authorized engineering stations and PLCs
Enforce access control lists on industrial switches and firewalls to block untrusted sources from reaching port 44818
Deploy an EtherNet/IP-aware intrusion prevention system to drop malformed CIP packets before they reach RSLinx
Monitor RSLinx Classic service state and configure automatic restart with alerting to reduce recovery time

bash

# Example Windows Firewall rule restricting CIP (EtherNet/IP) access to a trusted engineering subnet
netsh advfirewall firewall add rule ^
  name="RSLinx CIP - Restrict to Engineering Subnet" ^
  dir=in action=allow ^
  protocol=TCP localport=44818 ^
  remoteip=10.10.20.0/24

netsh advfirewall firewall add rule ^
  name="RSLinx CIP - Block Others" ^
  dir=in action=block ^
  protocol=TCP localport=44818