VulnHub

Real-time Cybersecurity News

Critical

Rockwell Automation ArmorStart LT

All CISA Advisories
CVEUpdateXSSCritical

Overview

Rockwell Automation has identified serious vulnerabilities in its ArmorStart LT product, specifically versions up to v2.001. These vulnerabilities could allow attackers to execute malicious scripts through cross-site scripting (XSS) attacks or cause a denial of service by sending crafted HTTP requests, leading to web server outages. Users are strongly advised to update to firmware version v2.002 to mitigate these risks. The vulnerabilities affect critical manufacturing systems worldwide, raising concerns about the security of industrial control systems. Organizations should act swiftly to ensure their systems are protected, following best practices for cybersecurity.

Key Takeaways

  • Affected Systems: Rockwell Automation ArmorStart LT versions <=v2.001
  • Action Required: Users should update to firmware version v2.
  • Timeline: Disclosed on 2026-09-03

Original Article Summary

View CSAF Summary Successful exploitation of these vulnerabilities could result in a loss of webserver availability or allow an attacker to inject malicious scripts that will be executed when other users access the affected page. The following versions of Rockwell Automation ArmorStart LT are affected: ArmorStart LT <=v2.001 (CVE-2026-19471, CVE-2026-19472) CVSS Vendor Equipment Vulnerabilities v3 7.5 Rockwell Automation Rockwell Automation ArmorStart LT Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Allocation of Resources Without Limits or Throttling Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-19471 Multiple stored cross-site scripting security issues exist within ArmorStart LT. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page. View CVE Details Affected Products Rockwell Automation ArmorStart LT Vendor: Rockwell Automation Product Version: Rockwell Automation ArmorStart LT: <=v2.001 Product Status: known_affected Remediations Mitigation Rockwell Automation has corrected this issue in firmware version v2.002, and encourages all users to update to the newest version. Mitigation Users of the affected software who are not able to upgrade to one of the corrected versions should follow Rockwell Automation's security best practices. https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight Mitigation For more information on this issue, see the Rockwell Automation security advisory at: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.3 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVE-2026-19472 A denial-of-service security issue exists within ArmorStart LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability. View CVE Details Affected Products Rockwell Automation ArmorStart LT Vendor: Rockwell Automation Product Version: Rockwell Automation ArmorStart LT: <=v2.001 Product Status: known_affected Remediations Mitigation Rockwell Automation has corrected this issue in firmware version v2.002, and encourages all users to update to the newest version. Mitigation Users of the affected software who are not able to upgrade to one of the corrected versions should follow Rockwell Automation's security best practices. https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight Mitigation For more information on this issue, see the Rockwell Automation security advisory at: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html Relevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Acknowledgments Rockwell Automation reported these vulnerabilities to CISA. Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2026-09-03 Date Revision Summary 2026-09-03 1 Initial Republication of Rockwell Automation security advisory. Legal Notice and Terms of Use

Impact

Rockwell Automation ArmorStart LT versions <=v2.001

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Disclosed on 2026-09-03

Remediation

Users should update to firmware version v2.002. If unable to upgrade, they should follow Rockwell Automation's security best practices to mitigate risks.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Update, XSS, and 1 more.

Read Original Article

Related Coverage

Ninja Forms plugin flaw exploited to hack WordPress sites

BleepingComputer

Hackers are actively exploiting security flaws in the Ninja Forms and WPC Product Bundles for WooCommerce WordPress plugins. These vulnerabilities allow attackers to execute stored cross-site scripting (XSS) attacks, which can lead to the installation of backdoors and the creation of unauthorized admin accounts on compromised sites. The impact is particularly concerning for website owners using these plugins, as it could lead to unauthorized access and control over their WordPress installations. Users should be vigilant and ensure their plugins are updated to protect against these attacks. The situation emphasizes the need for regular security checks and timely updates to safeguard web assets from exploitation.

Oct 6, 2026

ClickFix Attacks Evolve to Better Hide Malicious Payloads

darkreading

Recent developments in cyberattacks show that malicious actors are becoming more sophisticated in hiding their payloads. They are now using DNS TXT records and browser cache pre-fetching techniques to obscure their activities, making it harder for security teams to detect early signs of an attack. This evolution in tactics poses a significant challenge for organizations trying to protect their networks. As these methods become more prevalent, it is crucial for companies to enhance their monitoring capabilities and adapt their security strategies to identify these hidden threats. Users and organizations alike need to stay vigilant and informed about these evolving attack methods to better safeguard their systems.

Oct 6, 2026

Critical Healthcare Systems Aren't Quantum-Ready

darkreading

A recent study analyzed 2.5 million devices from 50 healthcare organizations and found that the industry is not adequately prepared for the future of quantum computing and its implications for data security. The research indicates that many healthcare systems are still relying on outdated cryptographic methods, which could leave sensitive patient data vulnerable as quantum technology advances. As quantum computers become more capable, they could potentially break current encryption standards, putting personal health information at risk. This lack of readiness is concerning for an industry that handles crucial and private data. The study calls for urgent upgrades to encryption methods to safeguard against future threats posed by quantum computing.

Oct 6, 2026

Hackers exploit 32 zero-days on first day of Pwn2Own Ireland

BleepingComputer

During the first day of the Pwn2Own Ireland 2026 competition, security researchers successfully hacked the Samsung Galaxy S26 twice, using 32 zero-day vulnerabilities. This impressive achievement earned them a total of $388,500 in prize money. The vulnerabilities exploited are a serious concern as they demonstrate the potential for attackers to compromise widely used devices. The competition, which focuses on discovering and reporting security flaws, underscores the ongoing challenges in mobile security. With these zero-days now identified, users of the Samsung Galaxy S26 should remain vigilant and await further guidance from the manufacturer regarding necessary security updates.

Oct 6, 2026

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

The Hacker News

Researchers have discovered Linux backdoors that are targeting telecom and network devices in South Korea and Taiwan. These backdoors cleverly disguise their malicious traffic as legitimate email services, making it difficult for security systems to detect them. Attackers often name their malware after real components of the operating system to avoid detection. This tactic not only helps the malware blend in but also poses significant risks to network security in these regions. The ongoing threat underscores the need for enhanced monitoring and detection measures in organizations that rely on Linux systems for critical infrastructure.

Oct 6, 2026

ASOS confirms data breach after “HACKED” in-app notifications

BleepingComputer

ASOS, the UK-based fashion retailer, has confirmed a data breach after hackers sent unauthorized push notifications through its mobile app. The attackers claimed to have accessed customer data from ASOS's Snowflake environment, raising concerns over the security of user information. While specific details about the stolen data have not been disclosed, the incident highlights vulnerabilities in the company's app security. Users of the ASOS mobile app should be on alert for potential phishing attempts or unusual activity in their accounts. This breach serves as a reminder for companies to prioritize data protection and for consumers to stay vigilant about their personal information online.

Oct 6, 2026