As reported by CISA in advisory ICSA-26-246-04, Rockwell Automation's ArmorStart LT integrated motor controller contains two vulnerabilities — a stored cross-site scripting flaw and a denial-of-service condition — affecting firmware versions up to and including v2.001. While neither vulnerability enables direct process manipulation, both undermine the integrity and availability of the device's web management interface, which operators rely on for configuration and diagnostics on the plant floor.
Why This Matters
ArmorStart LT devices are deployed worldwide across critical manufacturing environments. These are not datacenter assets sitting behind a corporate firewall — they are motor controllers bolted to production lines, often managed via embedded webservers that may be reachable from shared maintenance networks. Stored XSS in an OT context is more than a browser nuisance: a crafted payload could hijack an authenticated operator session, alter configuration parameters, or serve as a pivot point for broader network reconnaissance. The DoS vulnerability compounds this by enabling an attacker to take the webserver offline, forcing operators into degraded visibility precisely when they need it most.
The CVSS v3.1 score of 7.5 (HIGH) for the combined advisory reflects network-accessible attack surface with no authentication required. Notably, the CVSS v4.0 recalibration lands at 6.9 (MEDIUM), which may cause some risk-assessment frameworks to deprioritize patching. That would be a mistake. In OT environments, availability is the paramount pillar, and a DoS against a safety-relevant motor controller's management interface demands urgency regardless of the scoring model.
Vulnerability Details
| CVE | Type | CVSS v3.1 | Severity | Patch Status |
|---|---|---|---|---|
| CVE-2026-19471 | Stored Cross-Site Scripting (CWE-79) | 7.3 | HIGH | Fixed in v2.002 |
| CVE-2026-19472 | Denial of Service — Resource Allocation Without Limits (CWE-770) | 7.5 | HIGH | Fixed in v2.002 |
Affected product: Rockwell Automation ArmorStart LT, firmware version <= v2.001
Remediation: Firmware v2.002 available from Rockwell Automation
Active exploitation: No evidence of in-the-wild exploitation reported at time of advisory publication
Who Is at Risk
Critical manufacturing facilities running ArmorStart LT units with default or outdated firmware are the primary exposure group. Organizations with large, distributed fleets of Rockwell motor controllers — particularly those where maintenance networks are flat or lack segmentation between IT and OT zones — face the highest risk. Facilities that allow direct browser access to device webservers from multi-user workstations are especially susceptible to stored XSS exploitation, since a single injected payload can persist and trigger against every subsequent legitimate operator session.
Shield53 Recommendations
Immediate Actions
Broader Considerations
This advisory underscores a recurring pattern in OT security: embedded webservers in field devices remain a persistent attack surface. Asset owners should audit their environment for all Rockwell and third-party devices exposing HTTP management interfaces and establish a firmware lifecycle program that tracks vendor advisories as a routine operational practice — not an ad hoc response. The gap between CVSS v3.1 and v4.0 scoring on these CVEs also highlights the importance of contextual risk assessment over raw scores when prioritizing OT remediation.
