CVE-2026-9625
Received Received - Intake

Denial-of-Service in RSLinx Classic via CIP Packet

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Rockwell Automation

Description
A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet with an oversized embedded message request can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-9625
EUVD
EUVD-2026-69141

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
rockwellautomation rslinx_classic *
rockwellautomation rslinx_classic to 4.60 (exc)
rockwellautomation rslinx_classic 4.60

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service issue in RSLinx Classic. A specially crafted CIP packet with an oversized embedded message request can crash the service, requiring a manual restart to recover.

Detection Guidance

Detecting this vulnerability requires monitoring for crafted CIP packets targeting RSLinx Classic. Use network traffic analysis tools like Wireshark to inspect for oversized embedded message requests in CIP packets. Check RSLinx Classic logs for service crashes or unexpected restarts.

Impact Analysis

The crash of RSLinx Classic can disrupt communication between industrial control systems and other devices, leading to operational downtime and potential loss of control over connected systems.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions in industrial control systems that rely on RSLinx Classic. Downtime from crashes may lead to unauthorized access risks or data processing interruptions, which are critical under these regulations.

Mitigation Strategies

Apply the latest security patches from Rockwell Automation for RSLinx Classic. Restrict network access to RSLinx Classic ports using firewalls. Monitor service stability and implement intrusion detection systems to block malformed CIP packets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9625. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart