CISA 2026-09-01

Rockwell Automation RSLinx Classic

Machine-generated analysis · WAYSCloud LLM

RSLinx Classic versions up to 4.50 are vulnerable to denial-of-service via malformed CIP packets.

Context

The advisory concerns Rockwell Automation’s RSLinx Classic software, a communications driver used in industrial automation. Versions 4.50 and earlier are vulnerable to integer overflow/underflow and buffer overflow issues that can be triggered by a crafted CIP packet, leading to a denial-of-service condition requiring a service restart. Rockwell has released version 4.60 that corrects the vulnerabilities, and recommends applying security best practices for systems that cannot be upgraded.

Operator considerations

- Check: inventory any RSLinx Classic installations running version 4.50 or earlier.
- Patch: upgrade affected installations to RSLinx Classic version 4.60 or later.
- Log: monitor the RSLinx Classic service for unexpected crashes or restarts.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the affected product.

The following versions of Rockwell Automation RSLinx Classic are affected:

RSLinx Classic

Read the full advisory on CISA →