CVE-2019-10970

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Rockwell Automation PanelView 5510 (all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or later), a remote, unauthenticated threat actor with access to an affected PanelView 5510 Graphic Display, upon successful exploit, may boot-up the terminal and gain root-level access to the device’s file system.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	Rockwell Automation PanelView 5510	all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or later

References

http://www.securityfocus.com/bid/109105Third Party Advisory, VDB Entry
https://www.us-cert.gov/ics/advisories/icsa-19-190-02Mitigation, Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/109105Third Party Advisory, VDB Entry
https://www.us-cert.gov/ics/advisories/icsa-19-190-02Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Jul 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-109717.8The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path that CVE-2019-109725.5Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability can be triggered when an attacker provides the target with CVE-2019-109737.2Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the CVE-2019-109745.5NREL EnergyPlus, Versions 8.6.0 and possibly prior versions, The application fails to prevent an exception handler from being overwritten wi CVE-2019-109756.6An out-of-bounds read vulnerability has been identified in Fuji Electric Alpha7 PC Loader Versions 1.1 and prior, which may crash the system CVE-2019-109765.5Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sa CVE-2019-109777.5In Mitsubishi Electric MELSEC-Q series Ethernet module QJ71E71-100 serial number 20121 and prior, an attacker could send crafted TCP packets CVE-2019-109787.8Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited wh CVE-2019-109799.8SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password.CVE-2019-10986.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows CVE-2019-109807.8A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file. This may allow an att CVE-2019-109817.8In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an authenticated local user