CVE-2019-10952

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An attacker could send a crafted HTTP/HTTPS request to render the web server unavailable and/or lead to remote code execution caused by a stack-based buffer overflow vulnerability. A cold restart is required for recovering

CompactLogix 5370 L1, L2, and L3 Controllers, Compact GuardLogix 5370 controllers, and Armor Compact GuardLogix 5370 Controllers Versions 20 - 30 and earlier.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-400 CWE-787

Affected software

Vendor	Product	Versions
Rockwell Automation	CompactLogix 5370 L1 controllers	< 20 - 30
Rockwell Automation	CompactLogix 5370 L2 controllers	< 20 - 30
Rockwell Automation	CompactLogix 5370 L3 controllers	< 20 - 30
Rockwell Automation	Compact GuardLogix 5370 controllers	< 20 - 30
Rockwell Automation	Armor Compact GuardLogix 5370 controllers	< 20 - 30

References

http://www.securityfocus.com/bid/108118Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-120-01Third Party Advisory, US Government Resource
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1075979
http://www.securityfocus.com/bid/108118Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-120-01Third Party Advisory, US Government Resource
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1075979

Timeline

Published: May 1, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-109537.5ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some con CVE-2019-109547.5An attacker could send crafted SMTP packets to cause a denial-of-service condition where the controller enters a major non-recoverable fault CVE-2019-109556.1In Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and earlier, MicroLogix 1100 Controllers v14.00 CVE-2019-109567.2Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote au CVE-2019-109574.8Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote au CVE-2019-109587.2Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote au CVE-2019-1095910.0BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impac CVE-2019-10965.5An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Dis CVE-2019-109607.5Zebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user access to front panel options. If the option t CVE-2019-109618.8In Advantech WebAccess HMI Designer Version 2.1.9.23 and prior, processing specially crafted MCR files lacking proper validation of user sup CVE-2019-109625.3BD Alaris Gateway versions, 1.0.13,1.1.3 Build 10,1.1.3 MR Build 11,1.1.5, and 1.1.6, The web browser user interface on the Alaris Gateway W CVE-2019-109634.3Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which ma