CVE-2026-9625

CVE-2026-9625 is a denial-of-service flaw in Rockwell Automation's RSLinx Classic industrial communications software, caused by improper handling of input sizes (CWE-120) when parsing CIP (Common Industrial Protocol) messages. An attacker who can reach the RSLinx Classic service over a network can send a single crafted CIP packet containing an oversized embedded message request, which crashes the service. The impact is availability-only: the RSLinx Classic service stops and must be manually restarted to recover, with no evidence of code execution or data compromise (CVSS 4.0 scores availability impact High and all other impacts None). Any organization running RSLinx Classic on workstations or servers that connect operations or maintenance software to Allen-Bradley/Rockwell controllers is potentially affected, particularly where the service is reachable from enterprise or internet-facing networks. As of this writing there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates roughly a 0.3% probability of exploitation within 30 days.

What to do: Check Rockwell Automation's security advisory for CVE-2026-9625 for the affected version list and patched release, and apply the update when available. Until patched, restrict network access to hosts running the RSLinx Classic service and its EtherNet/IP CIP ports (commonly TCP/UDP 44818) from untrusted networks, and monitor for unexpected service crashes. If the service crashes, restart the RSLinx Classic service to restore operations.