ArmorStart LT CVE-2026-19471

Network-level access to the ArmorStart® LT embedded web server (HTTP/HTTPS) is required. Per the CVSS 4.0 PR:N metric, no authentication is required to submit the stored payload, meaning any host with connectivity to the device's web port can inject malicious content. Payload execution further requires that a legitimate user - an operator or engineer - browse to the affected page within the management interface; without that victim-side visit, the stored script does not execute. Limiting factors: (1) ICS best practices per NIST SP 800-82 and ICS-CERT call for ArmorStart® LT to reside on an isolated OT VLAN with no direct internet exposure, which restricts the attacker pool to those already present on the control network; (2) no specific non-default feature or configuration flag is identified as a prerequisite - the vulnerability is present in the standard web interface across all assessed versions.

The CVSS 4.0 base score of 6.9 (Medium) reflects a network-accessible attack with no privileges required and low impacts across confidentiality, integrity, and availability of the vulnerable system. One notable metric tension: Rockwell's advisory assigns UI:N, which is atypical for stored XSS - the attacker's injection step requires no user interaction, but payload execution depends on a victim passively browsing the affected page, which maps more precisely to CVSS 4.0 UI:P; the assigned UI:N may therefore overstate attacker ease and slightly inflate the score. EPSS data is absent from the available intelligence, so numerical exploitation probability cannot be assessed. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, placing real-world risk as theoretical at time of analysis. However, the OT/ICS deployment context introduces a risk amplifier absent from the base score: web management interfaces of motor controllers are accessed by operational staff whose session compromise could enable unauthorized configuration changes to physical industrial processes, a consequence disproportionate to the Low-rated CVSS impacts.

A threat actor with access to the OT network - via insider access, VPN compromise, or lateral movement from an IT environment - submits a crafted HTTP request containing a JavaScript payload to a vulnerable input field on the ArmorStart® LT web interface. The payload is stored on the device. When a plant engineer later opens the device's management console to review motor status or adjust parameters, the script executes silently in their browser, exfiltrating the session token or credentials to an attacker-controlled endpoint.