CVE-2019-10952: rockwell automation armor compact guardlogix 5370 controllers Uncontrolled Resource Consumption
Vulnerability summary
CVE-2019-10952 is a critical (CVSS 9.8) Uncontrolled Resource Consumption vulnerability in rockwell automation armor compact guardlogix 5370 controllers. EPSS estimates a 9.99% chance of exploitation in the next 30 days, higher than 95.5% of scored vulnerabilities.
Timeline
- 01-05-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An attacker could send a crafted HTTP/HTTPS request to render the web server unavailable and/or lead to remote code execution caused by a stack-based buffer overflow vulnerability. A cold restart is required for recovering CompactLogix 5370 L1, L2, and L3 Controllers, Compact GuardLogix 5370 controllers, and Armor Compact GuardLogix 5370 Controllers Versions 20 - 30 and earlier.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
9.99%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 9.99% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Rockwell automation5 products
- armor compact guardlogix 5370 controllers< 20 - 30
- compact guardlogix 5370 controllers< 20 - 30
- compactlogix 5370 l1 controllers< 20 - 30
- compactlogix 5370 l2 controllers< 20 - 30
- compactlogix 5370 l3 controllers< 20 - 30
Rockwellautomation4 products
- armor_compact_guardlogix_5370_firmware≥ 20.011, ≤ 30.014
- compactlogix_5370_l1_firmware≥ 20.011, ≤ 30.014
- compactlogix_5370_l2_firmware≥ 20.011, ≤ 30.014
- compactlogix_5370_l3_firmware≥ 20.011, ≤ 30.014
2 vendors · 9 products
References
3 links- ics-cert.us-cert.gov/advisories/ICSA-19-120-01X Refsource MISCThird Party AdvisoryUS Government Resource