Rockwell Automation RSLinx Classic v≤4.50 Suffers Multiple High‑Severity DoS Flaws (CVE‑2026‑9621‑9625)

Industrial control systems have a new threat vector: Rockwell Automation’s RSLinx Classic software is vulnerable to a series of denial‑of‑service (DoS) attacks. Attackers can send crafted CIP packets that trigger integer overflows, buffer overflows, or underflows, causing the RSLinx service to crash and requiring a restart.

Vulnerabilities

• CVE‑2026‑9621 – Improper handling of malformed packets leads to a classic buffer overflow.
• CVE‑2026‑9622 – Crafted packets targeting the Forward Close service cause a service crash.
• CVE‑2026‑9624 – Integer underflow or wraparound in packet parsing can trigger a crash.
• CVE‑2026‑9625 – Additional integer overflow conditions that destabilize the service.

Impact

The exploitation of any of these CVEs results in a DoS condition. The RSLinx Classic service terminates unexpectedly, leaving connected control systems offline until the service is manually restarted. In critical manufacturing environments, this can lead to production downtime and safety risks.

Affected Versions

• RSLinx Classic ≤ 4.50

Vendor Fix

Rockwell Automation has released version 4.60, which addresses all four CVEs. The patch removes the vulnerable packet parsing logic and adds bounds checking to prevent overflows.

Mitigation for Non‑Upgradable Systems

• Apply Rockwell Automation’s recommended security best practices for RSLinx Classic.
• Restrict network access to the RSLinx service, limiting exposure to trusted IP ranges.
• Enable logging and monitor for abnormal packet traffic patterns.
• Consider isolating the RSLinx service in a separate network segment.

Operators should prioritize upgrading to version 4.60 as soon as possible to eliminate the risk of service disruption.