Rockwell Automation Patches 12+ Vulnerabilities in RSLinx Classic, FactoryTalk, ControlFLASH, and ArmorStart — ICS Detection and Remediation Guide

Rockwell Automation has published a coordinated set of security advisories addressing more than a dozen vulnerabilities across its industrial software and hardware portfolio — including RSLinx Classic, FactoryTalk, ControlFLASH, and ArmorStart products. These are not niche utilities; they sit at the core of Allen-Bradley automation environments worldwide. RSLinx Classic is the ubiquitous communications gateway between engineering workstations and PLCs, FactoryTalk is the supervisory backbone of countless SCADA/HMI deployments, ControlFLASH is the standard firmware update mechanism for Allen-Bradley controllers, and ArmorStart devices are deployed directly on plant floors as distributed motor controllers.

For defenders in operational technology (OT) environments, this advisory batch is a priority-one patching and monitoring event. Vulnerabilities in this stack routinely enable privilege escalation on engineering workstations, denial of service against communications servers, and — in the worst case — a pivot path from the IT network down to safety-critical control logic. Organizations running Rockwell gear should treat this as an immediate inventory-and-remediation exercise, layered with compensating detection while maintenance windows are scheduled.

What Happened

Rockwell Automation released multiple concurrent advisories covering vulnerabilities in:

• RSLinx Classic — the legacy OPC/communications server used to bridge Windows hosts to Allen-Bradley PLCs over EtherNet/IP, ControlNet, and DF1.
• FactoryTalk product family — the HMI, historian, and services platform underlying most Rockwell SCADA deployments.
• ControlFLASH — the firmware flashing utility used to update controller firmware, a tool that runs with elevated privileges and directly touches control-layer devices.
• ArmorStart — distributed motor controllers deployed on the plant floor, reachable over EtherNet/IP.
• Additional Rockwell products covered in the same advisory batch.

The aggregate volume — more than a dozen distinct vulnerabilities in a single coordinated release — is characteristic of Rockwell's periodic security cadence, but it also signals meaningful attack surface being closed at once. Historically, flaws in this product set have included buffer overflows, DLL hijacking/search-order issues, improper privilege management, and denial-of-service conditions in EtherNet/IP protocol handling. Defenders should pull the individual advisories from the Rockwell security portal and map each one to their installed asset inventory rather than treating this as a single monolithic patch.

Why This Matters to Defenders

OT environments are uniquely constrained:

1. Patch windows are rare. Many plants patch quarterly or annually during scheduled outages. Attackers know this, and ICS-focused threat groups actively monitor vendor advisories to build capabilities against unpatched systems in the gap between disclosure and remediation.
2. These products bridge IT and OT. An engineering workstation running vulnerable RSLinx Classic or FactoryTalk software is a textbook pivot point — compromise the workstation via IT-side access, then ride legitimate automation protocols (EtherNet/IP, CIP) down to controllers.
3. ControlFLASH is a high-value target. Any vulnerability in the firmware update mechanism threatens the integrity of the control layer itself. Firmware-level manipulation is among the most damaging and hardest-to-detect ICS attack outcomes.
4. ArmorStart sits exposed on the floor. Distributed motor controllers are frequently on flat plant networks with minimal segmentation and almost no endpoint visibility.

If you operate Rockwell equipment, the correct posture right now is: assume your installed versions are affected until verified otherwise.

Technical Analysis

Affected Products and Platforms

All impacted components are either Windows-based software or EtherNet/IP-connected field devices. This shapes both the detection strategy (Windows endpoint telemetry plus industrial protocol monitoring) and the remediation strategy (software updates plus firmware updates).

Attack Surface and Exploitation Requirements

Based on the historical vulnerability classes affecting this exact product set, defenders should plan around three realistic exploitation scenarios:

• Local privilege escalation / code execution on engineering workstations. Flaws in RSLinx Classic and FactoryTalk services — which frequently run as SYSTEM or as privileged Windows services — can be weaponized after an attacker gains an initial foothold on the host. The observable behavior is the Rockwell process spawning unexpected child processes or loading unexpected modules.
• Malicious firmware or configuration delivery via ControlFLASH abuse. If the firmware delivery path is compromised or the utility's integrity checks are bypassed, an attacker can push modified firmware to controllers. Observable behavior includes unexpected ControlFLASH execution, firmware updates outside of maintenance windows, and version changes on controllers that nobody scheduled.
• Denial of service via malformed EtherNet/IP traffic. Vulnerabilities in protocol handling in ArmorStart devices and communications servers are typically triggered remotely with crafted CIP/EtherNet/IP packets — no authentication required on flat networks. Observable behavior is abnormal EtherNet/IP session volume, connections from hosts that have no business speaking CIP, and device faults/resets.

Exploitation Status

At the time of the advisory release, these patches address disclosed vulnerabilities ahead of confirmed widespread in-the-wild exploitation. However, defenders should not take comfort in that: ICS advisories of this scope are closely tracked by both criminal groups and state-aligned actors, and proof-of-concept development against OT protocol flaws routinely follows disclosure. The prudent assumption is that the window between "patched advisory" and "working exploit" is measured in weeks, not months. Check CISA's ICS advisories page and the Known Exploited Vulnerabilities (KEV) catalog for status changes on any CVEs assigned to these advisories.

Detection & Response

The detections below focus on the highest-fidelity, lowest-noise observable behaviors associated with abusing this product set: Rockwell software spawning shells, unexpected firmware-flashing activity, and anomalous EtherNet/IP communications.

Sigma Rules

---
title: Rockwell ICS Software Spawning Shell or Scripting Process
id: 3f8a1c54-7b2d-4e91-a6c3-9d0e2f5b8a71
status: experimental
description: Detects RSLinx Classic, FactoryTalk, or ControlFLASH processes spawning command shells, scripting engines, or LOLBins, consistent with post-exploitation abuse of vulnerable ICS software on engineering workstations.
references:
  - https://www.securityweek.com/rockwell-automation-patches-over-a-dozen-vulnerabilities-across-products/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1059
  - attack.impact
  - attack.t0831
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\RSLinx.exe'
      - '\RSLINXNG.exe'
      - '\ControlFLASH.exe'
      - '\FTActivationManager.exe'
      - '\FactoryTalkActivationMgr.exe'
      - '\RNADIRSrv.exe'
      - '\RnaDirServer.exe'
      - '\FTViewSE.exe'
      - '\Studio5000.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate Rockwell software does not spawn scripting engines in normal operation. Validate during vendor-supported maintenance actions.
level: high
---
title: ControlFLASH Execution Outside Maintenance Context
id: 8c2e6d19-4a7f-4b38-9e51-1c6a0d3f7b92
status: experimental
description: Detects execution of the ControlFLASH firmware update utility, which should only run during authorized controller firmware maintenance windows. Any execution outside change control is a high-fidelity indicator of potential firmware manipulation.
references:
  - https://www.securityweek.com/rockwell-automation-patches-over-a-dozen-vulnerabilities-across-products/
  - https://attack.mitre.org/techniques/T0839/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.impact
  - attack.t0839
  - attack.inhibit_response_function
  - attack.t0803
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\ControlFLASH.exe'
      - '\ControlFLASHPlus.exe'
      - '\ControlFLASHPlusCore.exe'
  condition: selection
falsepositives:
  - Authorized firmware updates during scheduled maintenance windows. Suppress via change-ticket correlation, not blanket exclusions.
level: high
---
title: Non-Automation Host Initiating EtherNet/IP Communication
id: 5d1b9e47-2c8a-4f63-b704-8e2a6c1d5f38
status: experimental
description: Detects processes other than known Rockwell/industrial software initiating outbound connections to TCP 44818 (EtherNet/IP) or TCP 2222 (EtherNet/IP I/O), indicating potential CIP scanning or unauthorized controller access from non-engineering hosts.
references:
  - https://www.securityweek.com/rockwell-automation-patches-over-a-dozen-vulnerabilities-across-products/
  - https://attack.mitre.org/techniques/T0840/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.discovery
  - attack.t0840
  - attack.lateral_movement
  - attack.t0843
logsource:
  category: network_connection
  product: windows
detection:
  selection_port:
    DestinationPort:
      - 44818
      - 2222
  filter_known_automation:
    Image|endswith:
      - '\RSLinx.exe'
      - '\RSLINXNG.exe'
      - '\ControlFLASH.exe'
      - '\Studio5000.exe'
      - '\RSLogix5000.exe'
      - '\RSLogix500.exe'
      - '\FTViewSE.exe'
      - '\RSLinxEnterprise.exe'
  condition: selection_port and not filter_known_automation
falsepositives:
  - Third-party SCADA integrations, historians, and OPC bridges. Build a per-environment allowlist of authorized EtherNet/IP clients.
level: high

KQL (Microsoft Sentinel / Defender)

The first query hunts for Rockwell processes spawning shells or scripting engines. The second hunts for anomalous EtherNet/IP connections surfaced through Defender network telemetry (or CEF/Syslog-ingested firewall data via CommonSecurityLog).

// Hunt: Rockwell ICS software spawning shells, script engines, or LOLBins
let lookback = 14d;
let rockwellParents = dynamic(["RSLinx.exe","RSLINXNG.exe","ControlFLASH.exe","ControlFLASHPlus.exe","FTActivationManager.exe","FactoryTalkActivationMgr.exe","RNADIRSrv.exe","RnaDirServer.exe","FTViewSE.exe","Studio5000.exe","RSLogix5000.exe"]);
let riskyChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","wmic.exe","certutil.exe","bitsadmin.exe","net.exe","net1.exe","sc.exe","schtasks.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ (rockwellParents)
| where FileName in~ (riskyChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, ReportId
| order by TimeGenerated desc;

// Hunt: Non-automation processes initiating EtherNet/IP (44818/2222) connections
let enipPorts = dynamic([44818, 2222]);
let knownAutomation = dynamic(["RSLinx.exe","RSLINXNG.exe","ControlFLASH.exe","Studio5000.exe","RSLogix5000.exe","FTViewSE.exe","RSLinxEnterprise.exe"]);
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemotePort in (enipPorts)
| where not(InitiatingProcessFileName in~ (knownAutomation))
| summarize ConnectionCount = count(), DistinctTargets = dcount(RemoteIP)
    by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| where DistinctTargets > 3 or ConnectionCount > 50
| order by DistinctTargets desc;

// Hunt: ControlFLASH execution events across the fleet (correlate with change tickets)
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName has "ControlFLASH"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName
| order by TimeGenerated desc;

Velociraptor VQL

This artifact hunts endpoints for Rockwell process anomalies and unexpected EtherNet/IP listeners/clients — suitable for sweeping engineering workstation VLANs before patch windows open.

-- Hunt: Rockwell ICS process anomalies and EtherNet/IP connections
-- Identifies Rockwell software with suspicious children plus any process
-- holding connections to EtherNet/IP ports.

SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(RSLinx|RSLINXNG|ControlFLASH|FTActivation|FactoryTalk|RNADIR|FTViewSE|Studio5000|RSLogix)'

-- Enumerate EtherNet/IP (44818) network connections on the endpoint
SELECT Pid, Name, Status, Laddr, Raddr
FROM netstat()
WHERE Raddr =~ ':44818'
   OR Raddr =~ ':2222'
   OR Laddr =~ ':44818'

-- Inventory installed Rockwell software versions for patch-gap analysis
SELECT FullPath, Name, Size, Mtime
FROM glob(globs='C:/Program Files*/Rockwell*/**/ControlFLASH*.exe')

Verification & Hardening Script

Use this PowerShell script to enumerate installed Rockwell products and versions across engineering workstations, flag likely-unpatched components, and audit whether ControlFLASH is present where it shouldn't be (e.g., HMI servers that never perform firmware work).

# Rockwell Automation Patch-Gap & Exposure Audit
# Run elevated on engineering workstations and HMI servers, or via GPO/SCCM/Intune sweep.

$report = @()

# 1. Enumerate installed Rockwell software from the registry (both hives)
$uninstallPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$rockwellApps = Get-ItemProperty $uninstallPaths -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'Rockwell|RSLinx|FactoryTalk|ControlFLASH|Studio 5000|RSLogix' } |
    Select-Object DisplayName, DisplayVersion, InstallDate, Publisher

foreach ($app in $rockwellApps) {
    $report += [PSCustomObject]@{
        Check    = 'InstalledProduct'
        Item     = $app.DisplayName
        Version  = $app.DisplayVersion
        Detail   = "Installed: $($app.InstallDate)"
        Risk     = 'Review against current Rockwell advisories'
    }
}

# 2. Check for ControlFLASH presence (should only exist on authorized engineering assets)
$cfPaths = @(
    "$env:ProgramFiles\Rockwell Automation\ControlFLASH",
    "${env:ProgramFiles(x86)}\Rockwell Automation\ControlFLASH",
    "$env:ProgramFiles\Rockwell\ControlFLASH Plus"
)
foreach ($p in $cfPaths) {
    if (Test-Path $p) {
        $report += [PSCustomObject]@{
            Check   = 'ControlFLASHPresence'
            Item    = $p
            Version = (Get-ChildItem $p -Recurse -Filter '*.exe' -ErrorAction SilentlyContinue |
                       Select-Object -First 1).VersionInfo.ProductVersion
            Detail  = 'Firmware utility present on this host'
            Risk    = 'HIGH if host is not an authorized engineering workstation - remove or restrict'
        }
    }
}

# 3. Check RSLinx Classic service state and listening exposure
$rslinxSvc = Get-Service -Name 'RSLinx*' -ErrorAction SilentlyContinue
foreach ($svc in $rslinxSvc) {
    $report += [PSCustomObject]@{
        Check   = 'RSLinxService'
        Item    = $svc.Name
        Version = ''
        Detail  = "Status: $($svc.Status) | StartType: $($svc.StartType)"
        Risk    = 'Verify patched version per Rockwell advisory; disable if unused'
    }
}

# 4. Audit local EtherNet/IP exposure (44818 listening on a workstation is unusual)
$enipListeners = Get-NetTCPConnection -LocalPort 44818,2222 -State Listen -ErrorAction SilentlyContinue
foreach ($l in $enipListeners) {
    $proc = Get-Process -Id $l.OwningProcess -ErrorAction SilentlyContinue
    $report += [PSCustomObject]@{
        Check   = 'EtherNetIPListener'
        Item    = "Port $($l.LocalPort)"
        Version = ''
        Detail  = "Listening process: $($proc.ProcessName) ($($proc.Path))"
        Risk    = 'Investigate - workstations rarely need to listen on EtherNet/IP'
    }
}

$report | Format-Table -AutoSize
$report | Export-Csv -Path "$env:TEMP\Rockwell_Audit_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "Audit exported to $env:TEMP\Rockwell_Audit_$(Get-Date -Format yyyyMMdd).csv"

Remediation

1. Inventory first, patch second. Export every Rockwell product and version in your environment (the script above is a starting point). Match each installation against the individual Rockwell advisories to determine applicability — "over a dozen vulnerabilities" means multiple advisories, each with its own affected-version ranges and fixed-version targets. Do not assume one updater covers everything.
2. Obtain patches and advisories from authoritative sources:
   • Rockwell Automation security advisories portal: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html
   • CISA ICS-CERT advisories (which typically mirror Rockwell disclosures with CVSS scoring and mitigation guidance): https://www.cisa.gov/news-events/cybersecurity-advisories?f%5B0%5D=advisory_type%3A93
3. Prioritize by exposure, not by CVSS alone. Internet-facing or IT-adjacent engineering workstations running vulnerable RSLinx Classic or FactoryTalk components are the top priority — they are the realistic entry point. ControlFLASH vulnerabilities matter most wherever the utility is installed broadly (it shouldn't be). ArmorStart firmware updates require plant-floor scheduling; plan them for the next maintenance outage but apply compensating controls immediately.
4. Compensating controls while awaiting patch windows:
   • Enforce strict network segmentation between IT and OT per IEC 62443 zones/conduits; restrict TCP 44818/2222 to explicitly authorized engineering assets via firewall rules.
   • Remove ControlFLASH from any host that does not have a documented firmware-maintenance role.
   • Disable RSLinx Classic services on hosts where the gateway function is not required.
   • Apply application allowlisting (AppLocker/WDAC) on engineering workstations to block unauthorized binaries in Rockwell install paths.
   • Deploy the Sigma and KQL detections above so that any exploitation attempt during the patch gap generates an alert.
5. Govern firmware integrity. Establish change-control correlation for all ControlFLASH executions and controller firmware version changes. An unexpected firmware version delta on a controller is a potential incident, not a maintenance footnote — treat it accordingly and involve your IR team.
6. Verify post-patch. After applying updates, re-run the audit script, confirm version numbers against the advisory's fixed versions, and validate that the Sigma/KQL detections are quiet during normal operations.
7. Monitor KEV. Subscribe to CISA KEV updates; if any CVE from this advisory batch is added, federal guidance (BOD 22-01 for federal civilian agencies) imposes binding remediation deadlines — use those dates as your internal SLA benchmark even if you're not federally obligated.

Bottom Line

Coordinated multi-product advisory releases from a vendor as central to industrial automation as Rockwell are a forcing function. The organizations that handle these well are the ones with an accurate OT asset inventory, pre-negotiated maintenance windows, and detection coverage that watches engineering workstations as the crown jewels they are. Patch on the fastest cycle your plant allows — and in the meantime, make sure you'd see someone trying.

Related Resources

Security Arsenal Alert Triage Automation AlertMonitor Platform Book a SOC Assessment platform Intel Hub