Skip to main content

RSLinx Classic CVE-2026-9625

| EUVDEUVD-2026-69141 HIGH
Classic Buffer Overflow (CWE-120)
2026-09-01 Rockwell GHSA-g4p9-gx72-j378
Buffer Overflow Rslinx Classic
8.7
CVSS 4.0 · Vendor: Rockwell
Share

Severity by source

Vendor (Rockwell) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-delivered single malformed CIP packet, no auth required, service crash only - availability high, no C/I impact, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Rockwell).

CVSS VectorVendor: Rockwell

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Sep 01, 2026 - 14:36 vuln.today
CVE Published
Sep 01, 2026 - 13:36 cve.org
HIGH 8.7

DescriptionCVE.org

A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet with an oversized embedded message request can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover.

AnalysisAI

Unauthenticated denial-of-service in Rockwell Automation RSLinx Classic allows a remote attacker to crash the communications service by sending a crafted CIP packet containing an oversized embedded message request. The buffer overflow (CWE-120) causes the RSLinx Classic service to terminate, requiring manual restart to restore industrial device connectivity. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation RSLinx Classic CIP listener (typically TCP/UDP port 44818) must be reachable from the attacker's network position. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) accurately reflects the threat: low complexity, no authentication, network-exploitable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Consult Rockwell Automation Security Advisory SD1794 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1794.html) for the vendor-released patch and exact fixed version - no specific fix version was independently confirmed from the available input data, so applying the vendor-recommended update is the primary action. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all RSLinx Classic deployments and assess criticality to production, then implement network access controls restricting CIP packet traffic to trusted engineering workstations and PLCs only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Rslinx Classic

View all
CVE-2018-10619 HIGH POC
7.8 Jun 07

An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.
CVE-2020-12001 CRITICAL
9.8 Jun 15

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versio
CVE-2026-9621 CRITICAL
9.2 Sep 01

Remote denial-of-service in Rockwell Automation RSLinx Classic allows an unauthenticated network attacker to crash the R
CVE-2026-9624 HIGH
8.7 Sep 01

Denial-of-service in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the communicati
CVE-2026-9622 HIGH
8.7 Sep 01

Denial-of-service in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the RSLinx Clas
CVE-2020-11999 HIGH
8.1 Jun 15

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versio
CVE-2020-10642 HIGH
7.8 Apr 13

In Rockwell Automation RSLinx Classic versions 4.11.00 and prior, an authenticated local attacker could modify a registr
CVE-2020-12005 HIGH
7.5 Jun 15

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versio
CVE-2020-12003 HIGH
7.5 Jun 15

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versio

Same weakness CWE-120 – Classic Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2016-10174 CRITICAL POC
9.8
CVE-2016-0099 HIGH POC
7.8
CVE-2016-6366 HIGH POC
8.8
CVE-2013-1331 HIGH
7.8
CVE-2013-0641 HIGH
7.8
CVE-2017-15222 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Share

CVE-2026-9625 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy