ArmorStart LT Gets Stored XSS, DoS Patches in v2.002
Two unauthenticated remote vectors (one that injects scripts, one that kills the webserver) fixed in a firmware update Rockwell shipped alongside the disclosure.
TL;DR
CISA published advisory ICSA-26-246-04 for Rockwell Automation ArmorStart LT, covering two vulnerabilities in firmware v2.001 and earlier. CVE-2026-19471 lets an unauthenticated attacker plant stored cross-site scripting payloads on the embedded webserver (CVSS 7.3). CVE-2026-19472 crashes that same webserver via a crafted HTTP PUT request (CVSS 7.5). Both are network-accessible and require no authentication. Rockwell shipped the fix in v2.002 and recommends all users update. The advisory is a republication of Rockwell's own disclosure; no known public exploitation has been reported to CISA.
ArmorStart LT is a motor controller deployed in critical manufacturing environments worldwide. The embedded webserver is the attack surface here, and both vulnerabilities are reachable without credentials.
CVE-2026-19471 is a stored XSS issue. The advisory describes it plainly: "user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page." The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3, HIGH. The confidentiality, integrity, and availability impacts are all scored low, but the attack complexity is low and no privileges are required. That's the one to patch first.
CVE-2026-19472 is a denial-of-service condition triggered by a crafted HTTP PUT request to the embedded webserver. It scores 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Rockwell classifies it under CWE-770, Allocation of Resources Without Limits or Throttling. The result is loss of webserver availability, not device bricking, but the management interface goes dark.
The advisory is CISA's republication of Rockwell's own security advisory. Rockwell reported the vulnerabilities to CISA. Mitigation is straightforward: update to firmware v2.002. For users who can't upgrade immediately, Rockwell points to its standard security best practices guidance.
This is the second CISA advisory for ArmorStart LT in 2026. The January advisory (ICSA-26-029-02) covered nine CVEs, all denial-of-service conditions in v2.002 and earlier, and at that time Rockwell had no patch available. The contrast is worth noting: this time the fix shipped alongside disclosure.
Published ·Deep Fathom