CVE-2026-9624: RSLinx Classic DoS Vulnerability

CVE-2026-9624 Overview

CVE-2026-9624 is a denial-of-service vulnerability affecting Rockwell Automation RSLinx Classic. The flaw exists in the service's handling of Common Industrial Protocol (CIP) packets. A crafted CIP packet triggers a crash due to insufficient data length validation, halting the service until an operator manually restarts it.

The underlying weakness is classified as an integer underflow [CWE-191]. Attackers can reach the vulnerable code path remotely over the network without authentication or user interaction. Because RSLinx Classic bridges Rockwell industrial devices to Windows-based engineering and SCADA applications, an outage disrupts data acquisition and control workflows on the operational technology (OT) network.

Critical Impact
An unauthenticated remote attacker can crash RSLinx Classic with a single crafted CIP packet, breaking connectivity between Windows hosts and Rockwell PLCs until the service is restarted.

Affected Products

Rockwell Automation RSLinx Classic (see vendor advisory SD1794 for affected versions)
Windows engineering and HMI/SCADA hosts running RSLinx Classic as an OPC/CIP gateway
Rockwell PLC deployments that depend on RSLinx Classic for driver connectivity

Discovery Timeline

2026-09-01 - CVE-2026-9624 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-9624

Vulnerability Analysis

RSLinx Classic parses CIP messages received over EtherNet/IP on TCP/UDP port 44818. The service reads length fields from attacker-controlled packet data and uses those values to bound subsequent buffer operations.

When a specially crafted CIP packet supplies a length value that the parser fails to validate, arithmetic on that field underflows [CWE-191]. The resulting out-of-range value drives an invalid memory access, and the RSLinx Classic service terminates. Recovery requires a manual service restart on the affected Windows host.

The vulnerability does not expose confidentiality or integrity. Availability, however, is directly impacted because RSLinx Classic mediates communication between Windows applications such as FactoryTalk, RSLogix, and OPC clients and downstream Rockwell PLCs. A crash therefore cascades into loss of view and loss of control on dependent HMI and engineering workstations.

Root Cause

The root cause is missing or incorrect length validation on a size field parsed from an inbound CIP packet. Subtraction against the attacker-controlled length produces an integer underflow that propagates into a buffer or loop-bounds calculation, causing the service to crash.

Attack Vector

The attack vector is network-based and requires no authentication, no user interaction, and low complexity. An adversary with reachability to the RSLinx Classic host on CIP/EtherNet/IP transports sends a single malformed packet to trigger the crash. Repeated packets sustain the outage.

No verified public proof-of-concept exists at time of writing. Technical details are described in the Rockwell Automation Security Advisory SD1794.

Detection Methods for CVE-2026-9624

Indicators of Compromise

Unexpected termination of the RSLinx Classic Windows service (RSLINX.EXE) with corresponding Application Error entries in the Windows Event Log.
Loss of connectivity from FactoryTalk, RSLogix, or OPC clients to Rockwell PLCs coinciding with inbound EtherNet/IP traffic on TCP/UDP 44818.
Malformed CIP packets with anomalous length fields observed at OT network boundaries.

Detection Strategies

Monitor for repeated crashes of RSLINX.EXE and Service Control Manager events indicating the RSLinx Classic service stopped unexpectedly.
Deploy ICS-aware network sensors that decode CIP and alert on length-field anomalies or malformed EtherNet/IP encapsulation.
Correlate PLC communication loss with prior EtherNet/IP traffic from untrusted sources to identify triggered denial-of-service events.

Monitoring Recommendations

Alert on any inbound EtherNet/IP traffic (TCP/UDP 44818) originating outside authorized engineering subnets.
Track service uptime for RSLinx Classic and generate tickets when the service restarts outside change windows.
Baseline CIP packet sizes and flag statistical outliers for review by OT security analysts.

How to Mitigate CVE-2026-9624

Immediate Actions Required

Apply the fixed RSLinx Classic version identified in Rockwell Automation Security Advisory SD1794 as soon as maintenance windows permit.
Restrict inbound access to TCP/UDP 44818 on RSLinx Classic hosts to a defined allowlist of engineering workstations and PLCs.
Segment the OT network from IT and remote-access zones using firewalls or unidirectional gateways per ISA/IEC 62443.

Patch Information

Rockwell Automation has published remediation guidance in Security Advisory SD1794. Consult the Rockwell Automation Security Advisory for the affected version list, fixed builds, and upgrade procedures. Rockwell customer accounts are required to view the full advisory content.

Workarounds

Block CIP/EtherNet/IP traffic from untrusted networks at perimeter firewalls when patching is not immediately feasible.
Place RSLinx Classic hosts behind an industrial DMZ and disable direct routing from corporate or remote-access networks.
Implement host-based firewall rules on Windows engineering stations to restrict port 44818 to known PLC IP addresses.
Configure Windows Service Recovery to automatically restart the RSLinx Classic service on failure, reducing outage duration while patches are staged.

bash

# Example: Windows firewall rule limiting inbound CIP traffic to trusted PLC subnet
netsh advfirewall firewall add rule name="RSLinx CIP Allow Trusted" ^
  dir=in action=allow protocol=TCP localport=44818 ^
  remoteip=10.20.30.0/24

netsh advfirewall firewall add rule name="RSLinx CIP Block Other" ^
  dir=in action=block protocol=TCP localport=44818

# Configure automatic service recovery
sc.exe failure "RSLinx Classic" reset= 86400 actions= restart/60000/restart/60000/restart/60000