EUVD-2026-69138
GHSA-x222-px97-5m97
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network packet with low complexity (AV:N/AC:L/PR:N/UI:N); availability-only crash (A:H, C/I:N), and S:C reflects impact on dependent PLC/HMI systems beyond the service.
Primary rating from Vendor (Rockwell).
CVSS VectorVendor: Rockwell
Lifecycle Timeline
2DescriptionCVE.org
A denial-of-service security issue exists within RSLinx® Classic. The security issue stems from improper handling of a malformed packet. A crafted CIP packet can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover
AnalysisAI
Remote denial-of-service in Rockwell Automation RSLinx Classic allows an unauthenticated network attacker to crash the RSLinx Classic service by sending a single crafted CIP (Common Industrial Protocol) packet, after which the service must be manually restarted to restore communications. The flaw is rooted in an integer-overflow (CWE-190) style mishandling of a malformed packet and carries a CVSS 4.0 base score of 9.2 driven by high availability impact on both the service and dependent systems. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to the RSLinx Classic service's CIP/EtherNet/IP listener and the ability to send a crafted (malformed) CIP packet - no authentication (PR:N), no user interaction (UI:N), and no special attack requirements (AT:N) per the CVSS 4.0 vector, so it works against default configurations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H/SA:H) describes an easy, unauthenticated, network-reachable attack with high availability impact on the vulnerable system and on subsequent systems that depend on it - a realistic and serious profile for an OT communications broker whose outage can halt HMI/SCADA visibility and control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory - apply the RSLinx Classic update described in Rockwell Automation advisory SD1794 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1794.html); an exact patched version number was not included in the provided data, so confirm the target build directly from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all RSLinx Classic deployments in production and non-production environments; implement firewall rules restricting CIP protocol access to only trusted, documented sources and segment OT networks from general corporate network access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Rslinx Classic
View allAn unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.
FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versio
Unauthenticated denial-of-service in Rockwell Automation RSLinx Classic allows a remote attacker to crash the communicat
Denial-of-service in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the communicati
Denial-of-service in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the RSLinx Clas
FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versio
In Rockwell Automation RSLinx Classic versions 4.11.00 and prior, an authenticated local attacker could modify a registr
FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versio
FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versio
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today