Executive Summary: Critical Telemetry Disruption on Industrial Floors
The Cybersecurity and Infrastructure Security Agency (CISA) has released Industrial Control Systems advisory ICSA-26-244-01, alerting critical infrastructure operators, industrial automation engineers, and plant security teams to multiple denial-of-service (DoS) vulnerabilities in Rockwell Automation RSLinx Classic.
RSLinx Classic is the de facto communications server used across thousands of global manufacturing plants, water treatment facilities, energy utilities, and chemical processing facilities. It translates OPC DA/HDA, DDE, and native Rockwell interfaces to communicate over EtherNet/IP with Allen-Bradley programmable logic controllers (PLCs), including the ControlLogix, CompactLogix, GuardLogix, and legacy PLC-5 families. Successful exploitation allows an unauthenticated, network-adjacent attacker to remotely crash the RSLinx communication server daemon, blinding human-machine interfaces (HMIs), supervisory SCADA displays, and historian telemetry feeds.
Vulnerability Breakdown & CIP Protocol Parsing Mechanics
The advisory identifies four distinct Common Vulnerability and Exposures (CVE) records, all rated with a CVSS v3.1 base score of 7.5 (High):
| CVE Identifier | Vulnerability Type (CWE) | CVSS v3.1 Vector | Trigger Mechanism |
|---|---|---|---|
| CVE-2026-9621 | Improper Input Validation (CWE-20) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Malformed generic CIP packet with truncated encapsulation header |
| CVE-2026-9622 | Improper Control Flow (CWE-670) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Crafted CIP 'Forward Close' connection termination request |
| CVE-2026-9624 | Improper Data Length Handling (CWE-130) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Mismatch between declared CIP payload length and socket stream bytes |
| CVE-2026-9625 | Uncontrolled Resource Consumption (CWE-400) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Oversized embedded message request exceeding internal buffer bounds |
Operational Impact: Severing the Purdue Model Level 2/3 Boundary
Within the Purdue Enterprise Reference Architecture (PERA / IEC 62443), RSLinx Classic occupies a pivotal gateway position spanning Level 2 (Area Supervisory Control) and Level 3 (Site Operations). It listens on TCP and UDP port 44818 (EtherNet/IP messaging) and TCP port 2222 (legacy Ethernet communication).
When an unhandled exception or memory crash occurs in the RSLinx service (RSLinx.exe):
- Loss of Operator Visibility: FactoryTalk View SE / ME operator workstations lose communication tags, rendering HMI graphics inactive and displaying communication failure indicators.
- Alarms & Safety Logging Frozen: Safety-critical threshold changes and automated batch recipe transfers stall, forcing plant managers to consider emergency manual shutdowns.
- Service Recovery Requirement: The crashed service cannot automatically recover from memory corruption; it requires an operator to log in locally with administrative credentials and manually restart the RSLinx service via the Windows Services management console.
Snort / Suricata Industrial Intrusion Detection Rules
Network defenders monitoring Level 2/3 boundary firewalls can deploy the following signature to detect malformed CIP Forward Close and anomalous encapsulation frames:
# Suricata / Snort Rule: Detect Malformed CIP Forward Close on EtherNet/IP
alert tcp any any -> any 44818 (
msg:"CST THREAT-ALERT: Rockwell RSLinx Classic Malformed CIP Forward Close DoS (CVE-2026-9622)";
flow:to_server,established;
content:"|6f 00|"; offset:0; depth:2; # Encapsulation command: Send RR Data
content:"|54 00|"; distance:20; within:4; # CIP Service: Forward Close
byte_test:2,<,12,0,relative; # Anomalous CIP data length header
classtype:denial-of-service;
sid:202609251;
rev:1;
)Industrial Mitigation & Engineering Playbook
- Upgrade to RSLinx Classic v4.60: Asset owners must plan maintenance windows to upgrade RSLinx Classic installations to version 4.60 or later, which introduces robust length verification and exception handling on all CIP connection objects.
- Apply IEC 62443-3-3 Conduit Segmentation: Restrict traffic targeting EtherNet/IP (TCP/UDP port 44818) strictly to authorized engineering workstations and SCADA servers. Prevent any direct routing from Level 3 enterprise networks or Level 4 corporate subnets.
- Harden Industrial Firewall Inspection: Configure industrial firewalls (e.g., Cisco ISA 3000, Hirschmann EAGLE, Fortinet FortiGate Rugged) with CIP Application Layer Filtering (DPI) to drop unverified CIP message extensions and unauthorized Forward Close frames.
