Rockwell Automationは火曜日、Logix/CompactLogixコントローラー、Flex I/Oデュアルポート Ethernet/IPアダプター、RSLinx産業用通信ソフトウェ

Rockwell Automation informed customers that patches are available for several vulnerabilities affecting its ICS controllers and software.

Rockwell Automation has closed more than a dozen vulnerabilities in software and controllers used at industrial facilities. The gravest of these flaws permit the disabling of control-system components, the execution of code on a device, or the acquisition of SYSTEM privileges in Windows. The problems therefore afflict not merely engineers' workstations, but also equipment directly engaged in governing production processes.

ロックウェル・オートメーションは、産業施設で使用されているソフトウェアおよびコントローラーに存在していた十数件の脆弱性を修正しました。最も深刻な欠陥では、制御システムのコンポーネントを停止させたり、デバイス上でコードを実行したり、Windowsで SYSTEM権限を取得したりすることが可能でした。

The industrial giant has released advisories for its RSLinx Classic, ArmorStart, ControlFLASH, FactoryTalk, and other products.

Rockwell Automation has issued patches and workarounds for more than a dozen vulnerabilities across its industrial automation products, including critical and high-severity flaws in RSLinx Classic, ControlLogix, CompactLogix, and other tools. The advisories cover denial-of-service, remote code execution, privilege escalation, and cross-site scripting issues, with CISA also publishing guidance for CVE-2026-9637....

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Rockwell Automation has patched more than a dozen vulnerabilities across several of its industrial automation products.

The RSLinx Classic software that connects your control devices can stop working if it receives a specially formed network packet.

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the affected product. The following versions of Rockwell Automation RSLinx Classic are affected: RSLinx Classic <=4.50 (CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625) CVSS Vendor Equipment Vulnerabilities v3 8.6 Rockwell Automation Rockwell Automation RSLinx Classic Integer Overflow or Wraparound, Integer Underflow (Wrap or Wraparound), Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-9621 A denial-of-service security issue exists within RSLinx Classic. The security issue stems from improper handling of a malformed packet. A crafted CIP packet can cause the RSLinx Classic service to crash, requiring a restart of the service to recover. View CVE Details Affected Products Rockwell Automation RSLinx Classic Vendor: Rockwell Automation Product Version: Rockwell Automation RSLinx Classic: <=4.50 Product Status: known_affected Remediations Vendor fix Rockwell Automation has corrected the vulnerabilities in RSLinx Classic version 4.60. Mitigation Users using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight. https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight Mitigation For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html. https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html Relevant CWE: CWE-190 Integer Overflow or Wraparound Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.6 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H 4.0 9.2 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVE-2026-9622 A denial-of-service security issue exists within RSLinx Classic. A crafted CIP packet targeting the Forward Close service can cause the RSLinx Classic service to crash, requiring a restart of the service to recover. View CVE Details Affected Products Rockwell Automation RSLinx Classic Vendor: Rockwell Automation Product Version: Rockwell Automation RSLinx Classic: <=4.50 Product Status: known_affected Remediations Vendor fix Rockwell Automation has corrected the vulnerabilities in RSLinx Classic version 4.60. Mitigation Users using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight. https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight Mitigation For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html. https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html Relevant CWE: CWE-191 Integer Underflow (Wrap or Wraparound) Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.6 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H 4.0 9.2 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVE-2026-9624 A denial-of-service security issue exists within RSLinx Classic. A crafted CIP packet can cause the RSLinx Classic service to crash due to insufficient data length validation, requiring a restart of the service to recover. View CVE Details Affected Products Rockwell Automation RSLinx Classic Vendor: Rockwell Automation Product Version: Rockwell Automation RSLinx Classic: <=4.50 Product Status: known_affected Remediations Vendor fix Rockwell Automation has corrected the vulnerabilities in RSLinx Classic version 4.60. Mitigation Users using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight. https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight Mitigation For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html. https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html Relevant CWE: CWE-191 Integer Underflow (Wrap or Wraparound) Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2026-9625 A denial-of-service security issue exists within RSLinx Classic. A crafted CIP packet with an oversized embedded message request can cause the RSLinx Classic service to crash, requiring a restart of the service to recover. View CVE Details Affected Products Rockwell Automation RSLinx Classic Vendor: Rockwell Automation Product Version: Rockwell Automation RSLinx Classic: <=4.50 Product Status: known_affected Remediations Vendor fix Rockwell Automation has corrected the vulnerabilities in RSLinx Classic version 4.60. Mitigation Users using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight. https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight Mitigation For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html. https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Acknowledgments Rockwell Automation reported these vulnerabilities to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2026-09-01 Date Revision Summary 2026-09-01 1 Initial Republication of Rockwell Automation Advisory Legal Notice and Terms of Use

ロックウェル・オートメーションは火曜日、産業オートメーション製品群で発見された10件を超える脆弱性について、パッチまたは回避策が利用可能になったと顧客に通知しました。 新たに公開されたアドバイザリのうち、深刻度が「クリティカル」とされているのは1件のみです。これはRSLinx Classic通信ソフトウェアに影響する

Windows 11 version 26H2 has entered the Release Preview Channel, but that does not make it generally available—or automatically suitable for every PC. Microsoft released build 26300.9278 to Release…

To work with Allen Bradley Emulator you need three softwares. Rslogix 500, Rslinx for communication, and Emulator to test the PLC logic.

Software is downloaded from https://compatibility.rockwellautomation.com/Pages/home.aspx RSLogix Download Cart Software needs to be installed in the following order: 1. RSLinx Classic Lite 2. RSLogix Emulate 500 3. RSLogix Micro Starter Lite Set each application's compatibility mode to Windows 7 and to run as administrator, then restart the computer. ### Configure RSLinx Click configure drivers icon on toolbar. RSLinx Classic Lite Add the Emulator driver 500 Emulator driver Add the RS-232 driver to connect to PLCs with a serial cable. RS-232 driver ### RSLogix First Program RSLogix - select processor type Enter a name, select PLC type, and select driver. RSLogix - I/O Configuration I/O Configuration is used to configure addon modules connected to PLC. RSLogix - Channel Configuration Channel Configuration is used to set the IP address on the network interface. RSLogix - Communications Use Communications to select the PLC RSLogix - Program running on PLC Right-click on inputs and select Toggle bit to turn them on/off RSLogix - Toggle Bit Example program with a switch to control a motor direction with a software interlock. RSLogix - Example Program

Rockwell Automation has released patches for multiple vulnerabilities affecting Logix and CompactLogix controllers, Flex I/O dual-port Ethernet/IP adapters, RSLinx, and the FactoryTalk suite. The issues include authentication bypass, privilege escalation, password changes through unauthorized access, and denial-of-service flaws, while the company says none of the newly patched bugs have been exploited...

A New Security Warning for the Industrial World Industrial environments are facing another reminder that cybersecurity is no longer limited to traditional computers and corporate networks. Rockwell Automation has released security updates addressing multiple vulnerabilities affecting widely used industrial control system (ICS) products, including Logix controllers, CompactLogix, Flex I/O, RSLinx, and FactoryTalk platforms. The vulnerabilities reportedly include authentication bypass issues, privilege escalation weaknesses, and denial-of-service flaws that could impact industrial operations if exploited.

Introduction: Iranian state-sponsored actors (IRGC Cyber Electronic Command, tracked as CyberAv3ngers/UNC5691) are actively exploiting internet‑exposed Rockwell Automation/Allen‑Bradley PLCs without needing zero‑day vulnerabilities. By abusing legitimate engineering tools such as Studio 5000 and RSLinx, attackers manipulate industrial processes directly—a classic “living‑off‑the‑land” technique adapted for OT environments (OT‑LOLBins). With over 5,200 exposed devices globally, nearly 75% in the U.S., this campaign poses an immediate risk to water, energy, and government facilities.