CISA republishes Rockwell Automation advisory on ArmorStart LT vulnerabilities
CISA said Rockwell Automation ArmorStart LT firmware v2.001 and earlier is affected by a stored cross-site scripting flaw and a denial-of-service issue, both fixed in v2.002.
CISA republished a Rockwell Automation advisory Sept. 3 warning that ArmorStart LT firmware version v2.001 and earlier has two vulnerabilities: a stored cross-site scripting flaw and a denial-of-service issue tied to crafted HTTP PUT requests.
CISA said the affected equipment is used in critical manufacturing and is deployed worldwide. Rockwell Automation corrected both issues in firmware version v2.002 and CISA urged users to update.
What CISA said
CISA identified CVE-2026-19471 as a stored cross-site scripting issue. In the advisory, the agency said stored XSS can happen when user input is not properly sanitized and is stored on a server, allowing malicious scripts to run when other users open the affected page.
CISA gave CVE-2026-19471 a CVSS v3.1 base score of 7.3 and a CVSS v4.0 base score of 6.9.
The second flaw, CVE-2026-19472, affects the embedded web server. CISA said the issue stems from improper handling of a crafted HTTP PUT request and can cause the web server to lose availability.
CISA rated CVE-2026-19472 at 7.5 under CVSS v3.1 and 8.7 under CVSS v4.0.
Background
The advisory lists Rockwell Automation as the vendor and ArmorStart LT as the affected product. CISA said the company headquarters are in the United States and that the product is known to be affected.
Rockwell Automation reported the vulnerabilities to CISA. CISA said no known public exploitation specifically targeting the issues had been reported to the agency at the time of publication.
CISA linked to Rockwell Automation’s security advisory page and a support article with mitigation guidance for users who cannot upgrade right away.
What happens next
CISA said affected users should update to the newest version. For those unable to upgrade, the agency pointed to Rockwell Automation security best practices and the vendor’s advisory materials.
The advisory’s initial release date is listed as Sept. 3, 2026, and revision 1 is marked as an initial republication of the Rockwell Automation security advisory.
Sources
- CISA Cybersecurity Advisories
- CISA CSAF reference in advisory
- Rockwell Automation security advisory page
- Rockwell Automation support article
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()