Loading vulnerability…
RSLinx Classic CIP Packet Denial of Service
CVE-2026-9624 is a denial-of-service vulnerability in Rockwell Automation RSLinx Classic caused by insufficient validation of data length in Common Industrial Protocol (CIP) packet handling. A remotely supplied crafted CIP packet can cause the RSLinx Classic service to crash. The service must be restarted to restore operation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation terminates the RSLinx Classic service, disrupting its communications and associated industrial-control functions until an operator restarts the service. The reported CVSS v4 base score is 8.7 (High).
If you can’t patch tonight, do this now.
Restrict and monitor access to CIP-capable interfaces, segment industrial-control networks from untrusted networks, and permit CIP traffic only from authorized hosts. Restart the RSLinx Classic service if a crash occurs.
Patch, then assume compromise.
Update RSLinx Classic to a vendor-fixed release and apply the relevant Rockwell Automation security patches.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.