Loading vulnerability…
RSLinx Classic Oversized CIP Embedded Message Denial of Service
CVE-2026-9625 is a denial-of-service vulnerability in Rockwell Automation RSLinx Classic. A remotely delivered, crafted Common Industrial Protocol (CIP) packet containing an oversized embedded message request can cause the RSLinx Classic service to crash. Recovery requires restarting the affected service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can disrupt RSLinx Classic availability by crashing its service. Communications and functions dependent on the service remain unavailable until an operator or recovery mechanism restarts it.
If you can’t patch tonight, do this now.
Restrict and filter CIP traffic at network boundaries, including rejecting oversized CIP packets before they reach RSLinx Classic. Monitor RSLinx Classic service health and availability to detect crash events and support rapid recovery.
Patch, then assume compromise.
Update RSLinx Classic to the latest software version available from Rockwell Automation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.