A denial‑of‑service flaw exists in the Forward Close service of RSLinx Classic. When a specially crafted CIP packet is processed, the service crashes and must be restarted to recover. The vulnerability is a CWE‑191 type integer overflow or signed‑ness flaw that allows an attacker to interrupt the availability of the RSLinx Classic service, disrupting industrial control traffic but not compromising confidentiality or integrity.

Rockwell Automation’s RSLinx Classic software, versions 4.50 and earlier, are affected by this issue.

The CVSS score of 8.7 indicates a high severity threat. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been observed yet. The attack is likely conducted over the network using a crafted CIP packet, and while exploitation may be possible from remote hosts, the actual likelihood remains uncertain. Nevertheless, the impact on availability is significant for environments that rely on RSLinx Classic for device communication.