Vulnerability Description
An attacker could send a crafted HTTP/HTTPS request to render the web server unavailable and/or lead to remote code execution caused by a stack-based buffer overflow vulnerability. A cold restart is required for recovering CompactLogix 5370 L1, L2, and L3 Controllers, Compact GuardLogix 5370 controllers, and Armor Compact GuardLogix 5370 Controllers Versions 20 - 30 and earlier.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rockwellautomation | Compactlogix 5370 L1 Firmware | >= 20.011, <= 30.014 |
| Rockwellautomation | Compactlogix 5370 L1 | - |
| Rockwellautomation | Compactlogix 5370 L2 Firmware | >= 20.011, <= 30.014 |
| Rockwellautomation | Compactlogix 5370 L2 | - |
| Rockwellautomation | Compactlogix 5370 L3 Firmware | >= 20.011, <= 30.014 |
| Rockwellautomation | Compactlogix 5370 L3 | - |
| Rockwellautomation | Armor Compact Guardlogix 5370 Firmware | >= 20.011, <= 30.014 |
| Rockwellautomation | Armor Compact Guardlogix 5370 | - |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/108118Third Party AdvisoryVDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-19-120-01Third Party AdvisoryUS Government Resource
- https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1075979
- http://www.securityfocus.com/bid/108118Third Party AdvisoryVDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-19-120-01Third Party AdvisoryUS Government Resource
- https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1075979
FAQ
What is CVE-2019-10952?
CVE-2019-10952 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An attacker could send a crafted HTTP/HTTPS request to render the web server unavailable and/or lead to remote code execution caused by a stack-based buffer overflow vulnerability. A cold restart is r...
How severe is CVE-2019-10952?
CVE-2019-10952 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-10952?
Check the references section above for vendor advisories and patch information. Affected products include: Rockwellautomation Compactlogix 5370 L1 Firmware, Rockwellautomation Compactlogix 5370 L1, Rockwellautomation Compactlogix 5370 L2 Firmware, Rockwellautomation Compactlogix 5370 L2, Rockwellautomation Compactlogix 5370 L3 Firmware.