RSLinx Classic CVE-2026-9625

RSLinx Classic CIP listener (typically TCP/UDP port 44818) must be reachable from the attacker's network position. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N). The vulnerability is triggered by any inbound CIP packet with an oversized embedded message request - no special protocol state or prior session establishment is specified in the description, suggesting the flaw is exploitable against a cold CIP listener. Exploitation is limited by typical OT network segmentation: environments following ICS security best practices (ISA/IEC 62443, NIST SP 800-82) that isolate the industrial zone from corporate IT and external networks will significantly reduce exposure. The impact is bounded to availability - no code execution, privilege escalation, or data access is possible through this vector.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) accurately reflects the threat: low complexity, no authentication, network-exploitable. Impact is limited strictly to availability - confidentiality and integrity are unaffected per both the CVSS metrics and the description. Despite no KEV listing and no confirmed public POC, the risk in OT/ICS contexts is elevated because: (1) RSLinx Classic is frequently deployed on engineering workstations with CIP ports exposed within flat industrial networks; (2) service disruption in ICS environments can cause production outages with safety or economic consequences disproportionate to traditional IT DoS; (3) a crash-and-restart cycle may create brief windows of blind control of attached PLCs. The purely-DoS nature and scope-unchanged (S:U) metrics limit the worst case to a service restart rather than code execution or data exfiltration. No EPSS data was provided; exploitation probability is inferred as moderate given the simplicity of the trigger (no special credentials, single malformed packet).

An attacker with network access to a flat industrial segment - or who has compromised a host on that segment - sends a single crafted EtherNet/IP packet to the RSLinx Classic service on port 44818, embedding an oversized message payload that overflows an internal buffer. No credentials or prior authentication are required. The RSLinx Classic service crashes immediately, severing communications between the engineering workstation and all attached Allen-Bradley PLCs and HMIs until an operator manually restarts the service, potentially causing production downtime.