ArmorStart LT CVE-2026-19472

The ArmorStart LT embedded web server must be network-reachable from the attacker's position - no authentication, no user interaction, and no special device configuration is required beyond network access to the HTTP service, as confirmed by the CVSS 4.0 vector (PR:N, UI:N, AC:L, AT:N). The attack is effective against the default configuration of any unit with its web server accessible. Exploitation is practically limited by network topology: devices properly isolated within an OT/ICS network segment behind industrial firewalls or data diodes, unreachable from IT networks or the internet, are not directly exploitable from those untrusted zones. The impact is also bounded - only the embedded web server loses availability; device operational functions (motor control logic) are not confirmed as affected by this vulnerability.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms a fully network-accessible, unauthenticated, low-complexity attack requiring no user interaction - the highest-risk attack surface profile for a DoS class vulnerability. No EPSS score was provided in the available intelligence, and the vulnerability is not listed in CISA KEV; no public exploit code has been identified at time of analysis. These absence signals modestly reduce immediacy, but do not diminish the structural risk: the wildcard CPE version range means all deployed units are affected, no safe fallback version is confirmed, and ICS environments often face significant operational constraints on patching cycles. The impact is scoped strictly to availability of the embedded web service; there is no confidentiality or integrity compromise indicated. The primary risk is operational disruption - loss of remote device management and monitoring capability - rather than data exfiltration or lateral movement. Network segmentation is the most effective compensating control in the interim, and any ArmorStart LT device directly reachable from untrusted networks should be treated as urgently needing remediation or isolation.

An attacker with network reachability to the ArmorStart LT device's HTTP port crafts and sends a malformed HTTP PUT request to the embedded web server. The server, lacking adequate resource throttling, fails to handle the request correctly and exhausts available processing resources, causing the web service to crash or hang. Plant engineers lose web-based access to device configuration and status monitoring until the device is power-cycled or the service is manually restored.