CVE-2026-9622 in RSLinx Classic
Summary
by MITRE • 09/01/2026
A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet targeting the Forward Close service can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in Rockwell Automation's RSLinx Classic software represents a critical denial-of-service condition stemming from improper input validation within the Control Information Protocol (CIP) implementation. Specifically, the flaw resides in the handling of Forward Close requests, which are essential for terminating established connections between client devices and the RSLinx service. When an attacker constructs a malicious CIP packet designed to exploit weaknesses in this specific service handler, it triggers an unhandled exception or memory corruption event within the application logic. This malformed input bypasses standard boundary checks, leading directly to the termination of the main process thread responsible for managing communication services.
From a technical perspective, this issue aligns with CWE-20 Improper Input Validation and potentially CWE-400 Resource Exhaustion if the crash results in resource leaks that prevent immediate recovery without manual intervention. The attack vector is network-based, allowing remote exploitation by an authenticated or unauthenticated user depending on the specific configuration of the RSLinx Classic instance and its exposure to internal networks. In industrial control environments where RSLinx serves as a critical bridge between PLCs and higher-level SCADA systems, such instability can disrupt data flow and monitoring capabilities significantly. The operational impact is characterized by an immediate service outage that necessitates manual intervention to restore functionality, thereby introducing downtime during which real-time process visibility and control are lost.
This type of vulnerability maps directly to the MITRE ATT&CK technique T1499 Endpoint Denial of Service, where adversaries aim to degrade or deny availability of critical systems rather than compromising confidentiality or integrity. In an Operational Technology context, denying access to configuration tools like RSLinx can hinder maintenance activities and emergency response efforts during a broader cyber incident. The requirement for service restart implies that the vulnerability does not allow for code execution but still poses a severe risk due to the mandatory human interaction required for recovery, which may be delayed in unattended or remote operational settings.
Mitigation strategies should prioritize immediate patching of RSLinx Classic to the latest version provided by Rockwell Automation, as vendors typically address such logic errors through updated input sanitization routines and stricter state machine validation. In environments where patching is not immediately feasible, network segmentation plays a vital role in limiting exposure. Restricting access to CIP ports used by RSLinx to only trusted management stations reduces the attack surface significantly. Additionally, deploying intrusion detection systems capable of identifying anomalous CIP packet structures can provide an early warning mechanism for attempted exploitation attempts before they result in service disruption.