Lucene search

[email protected]CVE-2019-10952

HistoryMay 01, 2019 - 8:29 p.m.

CVE-2019-10952

2019-05-0120:29:00

CWE-400

CWE-787

[email protected]

web.nvd.nist.gov

cve-2019-10952

http

https

remote code execution

buffer overflow

compactlogix 5370

security vulnerability

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

83.1%

JSON

An attacker could send a crafted HTTP/HTTPS request to render the web server unavailable and/or lead to remote code execution caused by a stack-based buffer overflow vulnerability. A cold restart is required for recovering

CompactLogix 5370 L1, L2, and L3 Controllers, Compact GuardLogix 5370 controllers, and Armor Compact GuardLogix 5370 Controllers Versions 20 - 30 and earlier.

Affected configurations

NVD

Node

rockwellautomationcompactlogix_5370_l1Match-

AND

rockwellautomationcompactlogix_5370_l1_firmwareRange20.011–30.014

Node

rockwellautomationcompactlogix_5370_l2Match-

AND

rockwellautomationcompactlogix_5370_l2_firmwareRange20.011–30.014

Node

rockwellautomationcompactlogix_5370_l3Match-

AND

rockwellautomationcompactlogix_5370_l3_firmwareRange20.011–30.014

Node

rockwellautomationarmor_compact_guardlogix_5370Match-

AND

rockwellautomationarmor_compact_guardlogix_5370_firmwareRange20.011–30.014

CPENameOperatorVersion
rockwellautomation:compactlogix_5370_l1_firmwarerockwellautomation compactlogix 5370 l1 firmwarele30.014

CPE	Name	Operator	Version
rockwellautomation:compactlogix_5370_l1_firmware	rockwellautomation compactlogix 5370 l1 firmware	le	30.014

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "CompactLogix 5370 L1 controllers",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "lessThan": "20 - 30",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "CompactLogix 5370 L2 controllers",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "lessThan": "20 - 30",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "CompactLogix 5370 L3 controllers",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "lessThan": "20 - 30",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Compact GuardLogix 5370 controllers",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "lessThan": "20 - 30",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Armor Compact GuardLogix 5370 controllers",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "lessThan": "20 - 30",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108118

ics-cert.us-cert.gov/advisories/ICSA-19-120-01

rockwellautomation.custhelp.com/app/answers/detail/a_id/1075979

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

83.1%

JSON

Related for CVE-2019-10952

nessus2 checkpoint_advisories1 prion1 cvelist1 nvd1 ics1