Rockwell Automation RSLinx Classic

1. Executive summary

CISA has republished a Rockwell Automation advisory (ICSA-26-244-01, 2026-09-01) covering four denial-of-service vulnerabilities in RSLinx Classic versions 4.50 and earlier: CVE-2026-9621 (CWE-190, CVSS v3.1 8.6 HIGH / v4.0 9.2 CRITICAL), CVE-2026-9622 (CWE-191, CVSS v3.1 8.6 HIGH / v4.0 9.2 CRITICAL), CVE-2026-9624 (CWE-191, CVSS v3.1 7.5 HIGH / v4.0 8.7 HIGH) and CVE-2026-9625 (CWE-120, CVSS v3.1 7.5 HIGH / v4.0 8.7 HIGH). All four are remotely triggerable without authentication or user interaction: a single crafted CIP (Common Industrial Protocol) packet crashes the RSLinx Classic service, which must be manually restarted to recover. Rockwell has fixed all four in RSLinx Classic 4.60. No known public exploitation has been reported to CISA, and none of the CVEs are listed as known-exploited. For EMEA financial services the direct exposure is limited — RSLinx Classic is OT-side industrial communications software (Critical Manufacturing sector) — but any client operating building management, physical security, cash-handling or data-centre infrastructure that runs Rockwell control systems inherits an availability risk on those systems, and the same advisory cycle contains related Rockwell controller firmware fixes that OT-adjacent estate owners should triage in the same pass.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The advisory is a vendor patch release for OT software with no reported exploitation, no incident, and no confirmed financial-sector dependency; a generic "patching exists" trigger would apply to virtually every advisory and is not a defensible basis for citing incident-management or reporting obligations. Clients with Rockwell assets inside their critical/important-business-function perimeter should nonetheless treat the fix under their existing ICT risk and change-management processes.

3. Technical analysis & attack chain

Affected product: Rockwell Automation RSLinx Classic, versions <=4.50 (known affected). Fixed in version 4.60. RSLinx Classic is the Windows-based communications server that sits between Rockwell/Allen-Bradley PLCs and SCADA/HMI/engineering clients, speaking CIP over EtherNet/IP (TCP/44818 in typical deployments — port not stated in the advisory; confirm against your own network baselines).

Confirmed attack chain (per advisory text)

1. Reconnaissance/access: The attacker needs only network reachability to a host running the RSLinx Classic service. All four vectors are AV:N/AC:L/PR:N/UI:N — no credentials, no user interaction, low attack complexity.
2. Delivery: The attacker sends a single crafted CIP packet to the RSLinx Classic service.
3. Crash: The malformed packet triggers one of four distinct memory-handling flaws (below) and the RSLinx Classic service crashes.
4. Impact: Denial of service only. The service does not self-recover; a manual restart of the service is required. No code execution, no confidentiality or integrity impact is claimed for any of the four CVEs (C:N/I:N/A:H across the board).

Per-CVE mechanism

Note that the two 8.6/9.2 entries carry Scope:Changed (S:C / SA:H) — the availability impact is assessed as extending beyond the vulnerable component itself, i.e. the crash degrades the dependent control-system communications, not just the RSLinx process. CVE-2026-9622 is the most operationally specific: the Forward Close service is the CIP connection-teardown path, meaning a trivially small packet that any device permitted to open a CIP connection can also send.

No payload, persistence, privilege escalation, C2, lateral movement or exfiltration — these are pure availability bugs. There is no indication of ransomware or extortion relevance beyond the generic observation that unauthenticated DoS primitives on OT gateway software are attractive for disruption.

Caveats and confidence: The advisory does not publish CVE-to-CVSS-table mapping beyond the order shown, does not name the vulnerable binary/service components, and gives no packet captures or proof-of-concept detail. The GitHub advisory (GHSA-gcxp-mxpm-5m5v) corroborates only CVE-2026-9624's description. No MITRE ATT&CK or threat-actor attribution exists in the source material; none should be assumed. No CISA KEV entries and no KEV remediation due-dates exist for these CVEs — do not treat any date as a compliance deadline.

Related Rockwell items in the same advisory cycle (context, not part of this advisory's scope): ICSA-26-244-03 (Logix Platform CIP DoS, CVSS 7.5/8.7, fixed in firmware V34.015/V35.014/V36.013/V37.011), ICSA-26-244-05 (Logix infinite-loop DoS via corrupt crafted data, CVSS 7.5/8.7, same firmware fixes), ICSA-26-197-06 (CompactLogix/ControlLogix/GuardLogix buffer overflow DoS, CVSS 8.6/9.2, MNRF requiring power cycle or program download), and ICSA-26-167-02 (RSLinx Classic third-party out-of-bounds read, CVSS 7.5/8.7, fixed in 4.60.00 or patch BF31213). Clients with Rockwell estates should triage these together.

4. Mitigation & containment

P1 — within 24 hours

• Inventory: Identify all Windows hosts running RSLinx Classic (check installed versions; anything <=4.50 is affected). Typical locations: engineering workstations, SCADA/HMI servers, OPC gateway hosts in plants, data centres, and building-management system head-ends.
• Containment where patching is not immediately possible: RSLinx Classic hosts should never be internet-reachable. Confirm the service is reachable only from the OT/ICS control network segment; block CIP/EtherNet/IP traffic (TCP/44818 and related CIP ports per your baseline) at the OT/business-network firewall. Restrict which hosts may open CIP connections to RSLinx servers — the Forward Close vector (CVE-2026-9622) requires only the ability to send CIP traffic.
• Where remote access is required, use an up-to-date VPN into the control network, per CISA guidance — recognising a VPN is only as secure as the connected devices.

P2 — within 72 hours

• Patch: Upgrade RSLinx Classic to version 4.60 on all affected hosts. This is the vendor fix for all four CVEs. Schedule via standard OT change control with an availability window — the upgrade touches the plant communications layer.
• Interim compensating controls for hosts that cannot be upgraded within the window: apply Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US) — network segmentation, firewalled control networks, and controlled remote access.
• Recovery readiness: Because the failure mode is a crashed service requiring manual restart, confirm operators know the restart procedure for RSLinx Classic and that monitoring will detect the service-down condition quickly.

P3 — within 7 days

• Verify upgrade completion across the estate and confirm no <=4.50 instances remain (including on engineering laptops and spare/standby machines).
• Triage the related Rockwell advisories listed in §3 if Logix-family controllers are present: firmware updates to V34.015, V35.014, V36.013 or V37.011 (Logix Platform and infinite-loop DoS), and the controller-specific versions in ICSA-26-197-06; for RSLinx Classic third-party vulnerability (ICSA-26-167-02), version 4.60.00 or patch BF31213.
• Harden the OT perimeter: ensure control-system networks remain isolated from business networks, and perform CISA's recommended impact analysis and risk assessment before deploying further defensive measures.

5. Indicators of compromise

No indicators of compromise available in the source material. These are unexploited software vulnerabilities, not an intrusion campaign; there are no hashes, domains, IPs or artefacts to pivot on. Detection should focus on the vulnerability surface (§6) and on service-crash behaviour.

6. Detection

The sources contain no threat artefacts (no malware strings, filenames, command lines or registry keys), so no YARA rule can be authored. However, the advisory describes a specific, observable failure mode — the RSLinx Classic service crashing and requiring restart — which supports behavioural monitoring on hosts running the affected versions.

title: RSLinx Classic Service Crash - Possible CVE-2026-9621/9622/9624/9625 DoS
id: 7a1c0d52-9e3f-4b18-a6d2-0f5c8e91b743
status: experimental
description: >
  Detects unexpected termination of the RSLinx Classic service on hosts running
  RSLinx Classic <=4.50, consistent with the crafted-CIP-packet denial-of-service
  described in CISA ICSA-26-244-01. Tune service names against your environment.
references:

  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-01
author: Adverse Trace
date: 2026-09-01
logsource:
  product: windows
  service: system
detection:
  selection_service_crash:
    Provider_Name: 'Service Control Manager'
    EventID: 7031
    param1|contains:

      - 'RSLinx'
  filter_planned_restart:
    EventID: 7035
  condition: selection_service_crash and not 1 of filter_*
falsepositives:

  - Legitimate service failures or planned maintenance restarts
  - Other software with 'RSLinx' in the service display name
level: medium

Additionally, monitor for repeated RSLinx service restarts on any host still running <=4.50, and alert on CIP traffic reaching RSLinx hosts from source addresses outside the authorised control-network allow-list. No packet-level signature can be authored from the advisory text — the specific malformed-packet structures are not published.

7. Sources

• CISA, Rockwell Automation RSLinx Classic, ICSA-26-244-01, https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-01, 2026-09-01
• GitHub Security Advisories, A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet can cause…, GHSA-gcxp-mxpm-5m5v, https://github.com/advisories/GHSA-gcxp-mxpm-5m5v (corroborates CVE-2026-9624 description)
• CISA, Rockwell Automation RSLinx Classic Third-Party Vulnerability, ICSA-26-167-02, https://www.cisa.gov/news-events/ics-advisories/icsa-26-167-02, 2026-06-16 (related, context)
• CISA, Rockwell Automation Logix Platform, ICSA-26-244-03, https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-03, 2026-09-01 (related, context)
• CISA, Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix, ICSA-26-244-05, https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-05, 2026-09-01 (related, context)
• CISA, Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix, ICSA-26-197-06, https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-06 (related, context)
• Rockwell Automation, Security Best Practices, https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US
• Rockwell Automation, Security Advisories, https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html

8. Adverse Trace position

This is a straightforward, well-documented availability vulnerability set with a clean vendor fix and no evidence of exploitation — severity is HIGH under CVSS v3.1 (8.6/7.5) and CRITICAL/HIGH under v4.0 (9.2/8.7) purely on the unauthenticated, network-reachable, no-user-interaction availability impact, and we do not inflate it beyond that: there is no code execution, no data exposure and no confirmed threat-actor interest. Direct risk to EMEA financial services is low-to-moderate and confined to clients with Rockwell-based OT estates — plant, facilities, BMS or physical-infrastructure systems — where a crashed RSLinx gateway degrades monitoring and control of the underlying processes; the Scope:Changed scoring on CVE-2026-9621/9622 correctly captures that downstream impact. The action is simple: enumerate RSLinx Classic installs, upgrade to 4.60, and confirm the service is unreachable from anything outside the control network. We will monitor for KEV listing, proof-of-concept publication or exploitation reporting against CVE-2026-9621 through CVE-2026-9625 and will reissue if the threat picture changes; clients with Logix-family controllers should expect a consolidated Rockwell firmware triage note covering ICSA-26-244-03, ICSA-26-244-05 and ICSA-26-197-06.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.