CVE-2026-9625: RSLinx Classic DoS Vulnerability

CVE-2026-9625 Overview

CVE-2026-9625 is a denial-of-service vulnerability in Rockwell Automation RSLinx® Classic. A crafted Common Industrial Protocol (CIP) packet containing an oversized embedded message request causes the RSLinx® Classic service to crash. Recovery requires a manual restart of the service.

The issue is classified under [CWE-120] Buffer Copy without Checking Size of Input. The flaw is exploitable over the network without authentication or user interaction. RSLinx® Classic acts as a communication bridge between Rockwell industrial control devices and Windows applications, so a service outage disrupts operator visibility and control of connected programmable logic controllers (PLCs).

Critical Impact
An unauthenticated remote attacker can crash the RSLinx® Classic service with a single malformed CIP packet, interrupting industrial communications until an operator manually restarts the service.

Affected Products

Rockwell Automation RSLinx® Classic (see vendor advisory SD1794 for affected versions)
Windows hosts running RSLinx® Classic as a CIP/EtherNet-IP gateway
FactoryTalk and downstream applications that depend on RSLinx® Classic connectivity

Discovery Timeline

2026-09-01 - CVE-2026-9625 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-9625

Vulnerability Analysis

RSLinx® Classic parses CIP packets received over EtherNet/IP to route messages between Windows applications and industrial devices. CIP supports encapsulation of embedded message requests inside outer packets for routing across multiple hops. The RSLinx® Classic service fails to correctly validate the declared size of an embedded message request before processing it.

When a client sends a CIP packet with an oversized embedded message request, the service reads or copies data beyond expected boundaries and terminates. The process does not automatically restart, so all CIP sessions handled by the service are lost. Operator workstations, human-machine interfaces (HMIs), and historians relying on RSLinx® Classic lose live data until an administrator restarts the service.

Root Cause

The root cause is a missing or insufficient bounds check on the length field of an embedded CIP message request, mapped to [CWE-120]. The service trusts the attacker-controlled size value in the encapsulated request header and processes the buffer without verifying that the declared length fits within the containing packet or allocated buffer.

Attack Vector

Exploitation requires network reachability to the TCP/UDP port used by RSLinx® Classic for EtherNet/IP (typically TCP/44818 and UDP/2222). No credentials or user interaction are required. An attacker with access to the operational technology (OT) network, or to any flat network segment that can reach the RSLinx® Classic host, can send the crafted CIP packet directly.

The vulnerability affects availability only. There is no confirmed impact on confidentiality or integrity of process data. However, in industrial environments a loss of communications between controllers and supervisory systems can force operators into degraded-mode operation and mask other malicious activity.

No public proof-of-concept exploit is currently listed for CVE-2026-9625, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list.

Detection Methods for CVE-2026-9625

Indicators of Compromise

Unexpected termination of the RSLinx Classic Windows service (RSLINX.EXE) followed by loss of CIP/EtherNet-IP connectivity from HMIs and historians.
Windows Application or System event log entries recording a crash of RSLINX.EXE with an access violation or unhandled exception.
Inbound EtherNet/IP traffic to TCP/44818 from hosts that are not authorized engineering workstations or PLCs.

Detection Strategies

Deploy OT-aware intrusion detection signatures that flag CIP Unconnected Send or Multiple Service Packet messages whose embedded request length exceeds the outer encapsulation payload length.
Alert on repeated TCP resets or session drops on TCP/44818 originating from a single RSLinx® Classic host, which typically indicate a service crash.
Correlate Windows Service Control Manager events for RSLinx Classic state transitions with network telemetry to identify remotely triggered outages.

Monitoring Recommendations

Continuously monitor the run state and process uptime of RSLINX.EXE on all engineering workstations and gateway hosts.
Capture NetFlow or full packet capture at the boundary between the enterprise and OT networks to retain evidence of malformed CIP traffic.
Baseline the set of source IP addresses that legitimately initiate CIP sessions to RSLinx® Classic hosts and alert on deviations.

How to Mitigate CVE-2026-9625

Immediate Actions Required

Review the Rockwell Automation Security Advisory SD1794 and apply the fixed RSLinx® Classic release for your version.
Restrict inbound access to TCP/44818 and UDP/2222 on RSLinx® Classic hosts to a known allowlist of engineering workstations and controllers.
Segment RSLinx® Classic hosts behind an OT firewall or industrial DMZ, following ISA/IEC 62443 zone-and-conduit guidance.
Establish a documented runbook for detecting an RSLinx Classic service crash and restarting it to shorten recovery time.

Patch Information

Rockwell Automation has published fix information in security advisory SD1794. Refer to the Rockwell Automation Security Advisory for the corrected RSLinx® Classic versions, download locations, and deployment notes. Apply the update during a planned maintenance window because upgrading the service will interrupt active CIP sessions.

Workarounds

Block CIP traffic from untrusted network segments using a deep-packet-inspection capable OT firewall.
Disable EtherNet/IP drivers in RSLinx® Classic on hosts that only require serial or DH+ connectivity.
Configure the RSLinx Classic Windows service with automatic restart on failure to reduce downtime while patching is scheduled.

bash

# Configure automatic recovery for the RSLinx Classic service on Windows
sc.exe failure "RSLinx Classic" reset= 86400 actions= restart/5000/restart/5000/restart/5000
sc.exe qfailure "RSLinx Classic"