Skip to main content

RSLinx Classic CVE-2026-9624

| EUVDEUVD-2026-69140 HIGH
Integer Underflow (CWE-191)
2026-09-01 Rockwell GHSA-gcxp-mxpm-5m5v
Denial Of Service Rslinx Classic
8.7
CVSS 4.0 · Vendor: Rockwell
Share

Severity by source

Vendor (Rockwell) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Unauthenticated network DoS with no confidentiality or integrity impact; scope unchanged as the crash is confined to the RSLinx Classic service process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Rockwell).

CVSS VectorVendor: Rockwell

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Metadata Corrected
Sep 01, 2026 - 14:40 vuln.today
tag: Integer Overflow removed
Analysis Generated
Sep 01, 2026 - 14:36 vuln.today
CVE Published
Sep 01, 2026 - 13:35 cve.org
HIGH 8.7

DescriptionCVE.org

A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet can cause the RSLinx® Classic service to crash due to insufficient data length validation, requiring a  restart of the service to recover.

AnalysisAI

Denial-of-service in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the communication service by sending a specially crafted CIP packet with a manipulated data length field. The root cause is an integer underflow (CWE-191) in the packet length validation routine, causing the service to terminate and requiring a manual restart to recover. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The RSLinx Classic service must be running and its CIP communication port (typically TCP 44818 or UDP 2222) must be reachable by the attacker over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) confirms a high-severity, unauthenticated, zero-complexity denial-of-service with no privileges or user interaction required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Consult Rockwell Automation security advisory SD1794 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1794.html) to obtain the patched release - a specific fixed version number is not confirmed in the available intelligence and should not be assumed. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all Rockwell Automation RSLinx Classic deployments in your environment and assess network exposure; implement firewall rules to restrict CIP packet access from external and untrusted network segments to trusted sources only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Rslinx Classic

View all
CVE-2018-10619 HIGH POC
7.8 Jun 07

An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.
CVE-2020-12001 CRITICAL
9.8 Jun 15

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versio
CVE-2026-9621 CRITICAL
9.2 Sep 01

Remote denial-of-service in Rockwell Automation RSLinx Classic allows an unauthenticated network attacker to crash the R
CVE-2026-9625 HIGH
8.7 Sep 01

Unauthenticated denial-of-service in Rockwell Automation RSLinx Classic allows a remote attacker to crash the communicat
CVE-2026-9622 HIGH
8.7 Sep 01

Denial-of-service in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the RSLinx Clas
CVE-2020-11999 HIGH
8.1 Jun 15

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versio
CVE-2020-10642 HIGH
7.8 Apr 13

In Rockwell Automation RSLinx Classic versions 4.11.00 and prior, an authenticated local attacker could modify a registr
CVE-2020-12005 HIGH
7.5 Jun 15

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versio
CVE-2020-12003 HIGH
7.5 Jun 15

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versio

Same weakness CWE-191 – Integer Underflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2015-5212 MEDIUM
6.8
CVE-2017-14496 HIGH POC
7.5
CVE-2014-8768 MEDIUM POC
5.0
CVE-2017-11757 CRITICAL POC
9.8
CVE-2024-23313 CRITICAL POC
9.8
CVE-2021-3323 CRITICAL POC
9.8
CVE-2021-21811 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-9624 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy