High severity · published Jan 16, 2020
CVE-2019-13524
GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versions(End of Life) may allow an attacker sending…
7.5
CVSS
1.5%
EPSS
No
On KEV
Description
GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versions(End of Life) may allow an attacker sending specially manipulated packets to cause the module state to change to halt-mode, resulting in a denial-of-service condition. An operator must reboot the CPU module after removing battery or energy pack to recover from halt-mode.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RC
Rx3i Cpe100 Firmware · Emerson
before r9.85 · source: NVD
RC
Rx3i Cpe115 Firmware · Emerson
before r9.85 · source: NVD
RC
Rx3i Cpe302 Firmware · Emerson
before r9.90 · source: NVD
RC
Rx3i Cpe305 Firmware · Emerson
before r9.90 · source: NVD
RC
Rx3i Cpe310 Firmware · Emerson
before r9.90 · source: NVD
RC
Rx3i Cpe330 Firmware · Emerson
before r9.90 · source: NVD
RC
Rx3i Cpe400 Firmware · Emerson
before r9.90 · source: NVD
RC
Rx3i Cpl410 Firmware · Emerson
before r9.90 · source: NVD
RC
Rx3i Cru320 Firmware · Emerson
All versions, or not specified · source: NVD