RSLinx Classic CVE-2026-9624

The RSLinx Classic service must be running and its CIP communication port (typically TCP 44818 or UDP 2222) must be reachable by the attacker over the network. The CVSS 4.0 vector confirms PR:N and UI:N - no authentication or user interaction is required, and the attack is effective against the default service configuration. Exploitation is limited to denial-of-service only; no confidentiality or integrity impact is achievable through this vector. Environments that enforce strict network segmentation restricting CIP port access to authorized engineering workstations only materially reduce exposure by preventing unauthenticated external packets from reaching the service.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) confirms a high-severity, unauthenticated, zero-complexity denial-of-service with no privileges or user interaction required. In ICS environments, RSLinx Classic serves as the communication backbone between HMIs, SCADA systems, and PLCs - crashing it disrupts operator visibility and remote configuration across the production floor. EPSS data is absent from available intelligence, and the vulnerability is not in the CISA KEV catalog at time of analysis, so active exploitation in the wild is not confirmed. No POC is publicly available. Despite the absence of active exploitation evidence, the combination of zero authentication requirements, broad network accessibility on standard CIP ports, and the operational criticality of RSLinx Classic in industrial environments means this should be treated as urgent - availability loss in OT contexts can directly translate to production outages or delayed safety responses.

An attacker with network access to the CIP port of a host running RSLinx Classic sends a single malformed CIP packet containing a manipulated data length field. The integer underflow in the RSLinx Classic service parser causes an immediate service crash, severing the communication link between engineering workstations and connected PLCs. Production operators lose real-time data visibility and remote reconfiguration capability until IT or OT staff manually restart the service, potentially causing production halts or delayed incident response.