Stored XSS & Resource‑Exhaustion Flaws (CVE‑2026‑19471, CVE‑2026‑19472) in Rockwell Automation ArmorStart LT Threaten Industrial‑Control Web Interfaces
What It Is – CISA has issued an advisory for two high‑severity (CVSS 3.0 7.5) vulnerabilities in Rockwell Automation ArmorStart LT ≤ v2.001. One is a stored cross‑site scripting (XSS) flaw that lets an attacker inject malicious scripts into pages viewed by other users; the other is an unchecked resource‑allocation issue that can exhaust the web server, causing denial‑of‑service.
Exploitability – Publicly disclosed CVEs; no public exploit code yet, but the flaws are trivial to weaponise in a targeted attack against the web UI of the device.
Affected Products – Rockwell Automation ArmorStart LT firmware ≤ v2.001 (industrial‑control web gateway).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that application‑level input validation controls remain effective – a single control objective that satisfies the “Secure Configuration Management” requirement across NIST CSF 2.0, ISO 27001, and other frameworks.
- Remediation (firmware v2.002) must be captured as defensible evidence in a Trust Center so auditors can see that the vulnerability was closed promptly.
- Ongoing monitoring of web‑server health and script‑injection alerts provides the audit trail enterprises demand when evaluating third‑party OT vendors.
Recommended Actions
- Upgrade all ArmorStart LT devices to firmware v2.002 immediately.
- Verify that input sanitisation is enforced on all web‑form fields; run a web‑application security scan to confirm the XSS vector is closed.
- Update your asset inventory and map the remediation to the “Application security / input validation” control objective in your chosen framework.
- Capture the firmware‑upgrade logs and scan reports as evidence for audit readiness.
Source: CISA Advisory – ICSA‑26‑246‑04