Lucene search

IcscertCVE-2019-10954

HistoryMay 01, 2019 - 7:29 p.m.

CVE-2019-10954

2019-05-0119:29:00

CWE-787

CWE-121

icscert

web.nvd.nist.gov

cve-2019-10954

smtp

denial-of-service

compactlogix

nvd

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.012

Percentile

85.2%

JSON

An attacker could send crafted SMTP packets to cause a denial-of-service condition where the controller enters a major non-recoverable faulted state (MNRF) in CompactLogix 5370 L1, L2, and L3 Controllers, Compact GuardLogix 5370 controllers, and Armor Compact GuardLogix 5370 Controllers Versions 20 - 30 and earlier.

Affected configurations

Nvd

Node

rockwellautomationcompactlogix_5370_l1_firmwareRange20.011–30.014

AND

rockwellautomationcompactlogix_5370_l1Match-

Node

rockwellautomationcompactlogix_5370_l2_firmwareRange20.011–30.014

AND

rockwellautomationcompactlogix_5370_l2Match-

Node

rockwellautomationcompactlogix_5370_l3_firmwareRange20.011–30.014

AND

rockwellautomationcompactlogix_5370_l3Match-

Node

rockwellautomationcompact_guardlogix_5370_firmwareRange20.011–30.014

AND

rockwellautomationcompact_guardlogix_5370Match-

Node

rockwellautomationarmor_compact_guardlogix_5370_firmwareRange20.011–30.014

AND

rockwellautomationarmor_compact_guardlogix_5370Match-

VendorProductVersionCPE
rockwellautomationcompactlogix_5370_l1_firmware*cpe:2.3:o:rockwellautomation:compactlogix_5370_l1_firmware:*:*:*:*:*:*:*:*
rockwellautomationcompactlogix_5370_l1-cpe:2.3:h:rockwellautomation:compactlogix_5370_l1:-:*:*:*:*:*:*:*
rockwellautomationcompactlogix_5370_l2_firmware*cpe:2.3:o:rockwellautomation:compactlogix_5370_l2_firmware:*:*:*:*:*:*:*:*
rockwellautomationcompactlogix_5370_l2-cpe:2.3:h:rockwellautomation:compactlogix_5370_l2:-:*:*:*:*:*:*:*
rockwellautomationcompactlogix_5370_l3_firmware*cpe:2.3:o:rockwellautomation:compactlogix_5370_l3_firmware:*:*:*:*:*:*:*:*
rockwellautomationcompactlogix_5370_l3-cpe:2.3:h:rockwellautomation:compactlogix_5370_l3:-:*:*:*:*:*:*:*
rockwellautomationcompact_guardlogix_5370_firmware*cpe:2.3:o:rockwellautomation:compact_guardlogix_5370_firmware:*:*:*:*:*:*:*:*
rockwellautomationcompact_guardlogix_5370-cpe:2.3:h:rockwellautomation:compact_guardlogix_5370:-:*:*:*:*:*:*:*
rockwellautomationarmor_compact_guardlogix_5370_firmware*cpe:2.3:o:rockwellautomation:armor_compact_guardlogix_5370_firmware:*:*:*:*:*:*:*:*
rockwellautomationarmor_compact_guardlogix_5370-cpe:2.3:h:rockwellautomation:armor_compact_guardlogix_5370:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rockwellautomation	compactlogix_5370_l1_firmware	*	cpe:2.3:o:rockwellautomation:compactlogix_5370_l1_firmware::::::::
rockwellautomation	compactlogix_5370_l1	-	cpe:2.3:h:rockwellautomation:compactlogix_5370_l1:-:::::::*
rockwellautomation	compactlogix_5370_l2_firmware	*	cpe:2.3:o:rockwellautomation:compactlogix_5370_l2_firmware::::::::
rockwellautomation	compactlogix_5370_l2	-	cpe:2.3:h:rockwellautomation:compactlogix_5370_l2:-:::::::*
rockwellautomation	compactlogix_5370_l3_firmware	*	cpe:2.3:o:rockwellautomation:compactlogix_5370_l3_firmware::::::::
rockwellautomation	compactlogix_5370_l3	-	cpe:2.3:h:rockwellautomation:compactlogix_5370_l3:-:::::::*
rockwellautomation	compact_guardlogix_5370_firmware	*	cpe:2.3:o:rockwellautomation:compact_guardlogix_5370_firmware::::::::
rockwellautomation	compact_guardlogix_5370	-	cpe:2.3:h:rockwellautomation:compact_guardlogix_5370:-:::::::*
rockwellautomation	armor_compact_guardlogix_5370_firmware	*	cpe:2.3:o:rockwellautomation:armor_compact_guardlogix_5370_firmware::::::::
rockwellautomation	armor_compact_guardlogix_5370	-	cpe:2.3:h:rockwellautomation:armor_compact_guardlogix_5370:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "CompactLogix 5370 L1 controllers",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "lessThan": "20 - 30",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "CompactLogix 5370 L2 controllers",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "lessThan": "20 - 30",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "CompactLogix 5370 L3 controllers",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "lessThan": "20 - 30",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Compact GuardLogix 5370 controllers",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "lessThan": "20 - 30",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Armor Compact GuardLogix 5370 controllers",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "lessThan": "20 - 30",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108118

ics-cert.us-cert.gov/advisories/ICSA-19-120-01

rockwellautomation.custhelp.com/app/answers/detail/a_id/1075979

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.012

Percentile

85.2%

JSON

Related for CVE-2019-10954