Rockwell RSLinx Classic needs 4.60 upgrade to fix four DoS flaws
Two of the four vulnerabilities carry CVSS 4.0 scores of 9.2, and none require authentication, a malformed CIP packet to port 44818 is all it takes to crash the service.
TL;DR
CISA issued an advisory covering four denial-of-service vulnerabilities in Rockwell Automation RSLinx Classic versions 4.50 and earlier. Each can be triggered remotely by sending a malformed CIP packet to the affected service, no authentication required. The fix is an upgrade to version 4.60. The product is deployed globally across critical manufacturing, and the two highest-severity CVEs (CVE-2026-9621, CVE-2026-9622) score 9.2 under CVSS v4.0. Rockwell hasn't published a timeline for mitigations on systems that can't move off 4.50.
Rockwell Automation's RSLinx Classic has been carrying denial-of-service vulnerabilities in its CIP packet handling for years, the research section of CISA's advisory archive shows a stack of prior buffer-overflow and resource-exhaustion CVEs stretching back to 2015, several with CVSS v3 scores of 10.0. This week's advisory adds four more.
The mechanics are familiar: an unauthenticated attacker sends a malformed CIP packet to port 44818, and the RSLinx Classic service crashes. CVE-2026-9621 and CVE-2026-9622 (integer overflow and integer underflow, respectively) both score 9.2 under CVSS v4.0, with the "C" (changed scope) flag indicating the crash impact extends beyond the vulnerable component. CVE-2026-9624 and CVE-2026-9625 are slightly lower severity (8.7 under v4.0) but operate on the same principle: craft a bad packet, crash the service, wait for someone to notice the line is down.
The fix is RSLinx Classic 4.60. Rockwell's advisory directs users who can't upgrade to its general security best practices document, which is the same boilerplate mitigation language appended to every recent advisory, not a patch-specific workaround. For the 2019 CVE-2019-6553 (also a 10.0), Rockwell offered a specific port-disabling mitigation: uncheck "Accept UDP Messages on Ethernet Port" in the RSLinx Classic options. No equivalent targeted mitigation appears in the current advisory.
The practical question for Monday morning is whether the engineering team can schedule a 4.60 upgrade window, or whether production lines running 4.50 will keep accepting CIP packets on 44818 until the next maintenance cycle. The CISA advisory doesn't answer that question, and neither does Rockwell's advisory page.
Published ·Deep Fathom