CVE-2019-10952

Опубликовано: 01 мая 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

CompactLogix 5370 L1, L2, and L3 Controllers, Compact GuardLogix 5370 controllers, and Armor Compact GuardLogix 5370 Controllers Versions 20 - 30 and earlier.

Ссылки

http://www.securityfocus.com/bid/108118
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-120-01
Third Party Advisory
US Government Resource
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1075979
http://www.securityfocus.com/bid/108118
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-120-01
Third Party Advisory
US Government Resource
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1075979

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:rockwellautomation:compactlogix_5370_l1_firmware:*:*:*:*:*:*:*:*

Версия от 20.011 (включая) до 30.014 (включая)

cpe:2.3:h:rockwellautomation:compactlogix_5370_l1:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:rockwellautomation:compactlogix_5370_l2_firmware:*:*:*:*:*:*:*:*

Версия от 20.011 (включая) до 30.014 (включая)

cpe:2.3:h:rockwellautomation:compactlogix_5370_l2:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:rockwellautomation:compactlogix_5370_l3_firmware:*:*:*:*:*:*:*:*

Версия от 20.011 (включая) до 30.014 (включая)

cpe:2.3:h:rockwellautomation:compactlogix_5370_l3:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:rockwellautomation:armor_compact_guardlogix_5370_firmware:*:*:*:*:*:*:*:*

Версия от 20.011 (включая) до 30.014 (включая)

cpe:2.3:h:rockwellautomation:armor_compact_guardlogix_5370:-:*:*:*:*:*:*:*

EPSS

Процентиль: 67%

0.00531

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-400

CWE-787

Связанные уязвимости

GHSA-cgc7-wrh2-gfjh

CVSS3: 9.8

github

больше 3 лет назад

An attacker could send a crafted HTTP/HTTPS request to render the web server unavailable and/or lead to remote code execution caused by a stack-based buffer overflow vulnerability. A cold restart is required for recovering CompactLogix 5370 L1, L2, and L3 Controllers, Compact GuardLogix 5370 controllers, and Armor Compact GuardLogix 5370 Controllers Versions 20 to 30.014 and earlier systems.

EPSS

Процентиль: 67%

0.00531

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-400

CWE-787