Rockwellautomation Compactlogix 5370 l1 Firmware vulnerabilities

5 CVEs affecting Rockwellautomation Compactlogix 5370 l1 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-6998, published 2022-07-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-10952, published 2019-05-01. Critical severity, CVSS 9.8. EPSS: 10% chance of exploitation in the next 30 days. An attacker could send a crafted HTTP/HTTPS request to render the web server unavailable and/or lead to remote code execution caused by a stack-based buffer overflow vulnerability. A cold restart is…
CVE-2019-10954, published 2019-05-01. High severity, CVSS 7.5. EPSS: 6.1% chance of exploitation in the next 30 days. An attacker could send crafted SMTP packets to cause a denial-of-service condition where the controller enters a major non-recoverable faulted state (MNRF) in CompactLogix 5370 L1, L2, and L3…
CVE-2022-1161, published 2022-04-11. Critical severity, CVSS 9.8. EPSS: 5.2% chance of exploitation in the next 30 days. An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix Control systems. Studio 5000 Logix Designer writes user-readable…
CVE-2020-6998, published 2022-07-27. High severity, CVSS 8.6. EPSS: 3.2% chance of exploitation in the next 30 days. The connection establishment algorithm found in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versions 33 and prior does not sufficiently manage its control flow during execution,…
CVE-2019-10955, published 2019-04-25. Medium severity, CVSS 6.1. EPSS: 3.1% chance of exploitation in the next 30 days. In Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and earlier, MicroLogix 1100 Controllers v14.00 and earlier, CompactLogix 5370 L1 controllers v30.014 and…