Rockwell Automation RSLinx Classic (CVE-2026-9621, CVE-2026-9622, CVE-2026-9624 +1 more)

What Happened

Security researchers found four flaws in Rockwell Automation's RSLinx Classic software (used in industrial control systems) that could let an attacker crash the program over a network. Anyone using versions 4.50 or older is affected. If exploited, these flaws could disrupt manufacturing processes that rely on this software. Organizations should update to version 4.60 immediately or follow network security best practices to protect their systems.

Key Takeaways

• Four denial-of-service vulnerabilities (CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625) affect Rockwell Automation RSLinx Classic versions 4.50 and earlier.
• The flaws stem from integer overflows, integer underflows, and buffer overflows in the handling of crafted CIP packets.
• Successful exploitation requires no privileges or user interaction and can be executed over the network.
• A vendor fix is available in RSLinx Classic version 4.60.
• CISA recommends minimizing network exposure for control system devices and isolating them from the internet.

Affected Systems

• Rockwell Automation RSLinx Classic <= 4.50

Vulnerabilities (CVEs)

Attack Chain

1. Initial Access: Attacker sends crafted CIP packets over the network to the RSLinx Classic service.
2. Exploitation: Malformed packet triggers integer overflow, integer underflow, or buffer overflow.
3. Impact: RSLinx Classic service crashes, causing a denial-of-service condition requiring manual restart.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No detection rules are provided in the advisory. The article provides remediation and mitigation steps instead of detection logic.

Detection Engineering Assessment

Required Log Sources

• Network flow logs
• ICS firewall logs
• CIP protocol analyzer logs

Hunting Hypotheses

Control Gaps

• Standard IT endpoint detection may not cover ICS protocols like CIP.
• Legacy ICS devices may lack endpoint detection capabilities.

Key Behavioral Indicators

• Unusual CIP traffic patterns
• Oversized or malformed CIP packet requests
• Unexpected termination of the RSLinx Classic process

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Minimize network exposure for all control system devices and ensure they are not accessible from the internet.
• Isolate control system networks from business networks using firewalls.
• Use VPNs for remote access requirements and ensure they are updated to the most current version available.

User Protection

• N/A

Security Awareness

• Train staff on recognizing and avoiding social engineering attacks that could be used to gain initial access to the network.
• Instruct staff not to click web links or open attachments in unsolicited email messages.

MITRE ATT&CK Mapping