RSLinx Classic CVE-2026-9622

No authentication is required; the CVSS 4.0 vector specifies PR:N and UI:N, confirming unauthenticated network exploitation against any reachable RSLinx Classic instance. The only prerequisite is network reachability to the RSLinx Classic CIP listener, typically EtherNet/IP on TCP port 44818. The vulnerability is limited strictly to availability impact - the CVSS vector explicitly sets VC:N/VI:N and SC:N/SI:N, meaning confidentiality and integrity are not compromised. Exploitation is limited by network segmentation: environments enforcing IT/OT DMZ boundaries with strict ingress filtering on CIP ports will not expose this service to untrusted networks. No special product configuration or non-default feature is required - the Forward Close service is a standard, always-active CIP function.

The CVSS 4.0 score of 8.7 reflects a network-exploitable, unauthenticated, low-complexity DoS with high availability impact, and these metrics are consistent with the description - no inflation is apparent. In ICS/OT environments, availability loss in a communication server like RSLinx Classic can cascade into production halts, operator blind spots, and extended recovery windows requiring physical access to restart the service. EPSS data is absent from available intelligence, preventing probabilistic exploitation assessment. The vulnerability is not in the CISA KEV catalog, so active exploitation is unconfirmed. The CIP protocol is well-documented and the Forward Close service structure is publicly specified, meaning the integer underflow trigger may be discoverable through protocol fuzzing without specialized tooling - this lowers the barrier for targeted exploitation. Flat OT networks without IT/OT segmentation are at the highest risk; environments with strict industrial DMZ controls are substantially protected.

An attacker with network reachability to the RSLinx Classic host - via a flat plant network, a compromised engineering workstation, or an IT/OT convergence segment - sends a single malformed EtherNet/IP packet containing a crafted CIP Forward Close service request. The integer underflow in the packet parser causes immediate termination of the RSLinx Classic service process. Any SCADA, HMI, or OPC client relying on RSLinx Classic for device communication loses connectivity until an operator manually restarts the service.