1783 Natr Firmware
Monthly
Configuration modification in Rockwell Automation 1783-NATR firmware can be triggered by a remote attacker who convinces an authenticated administrator to visit a crafted link. The affected form lacks a CSRF token, so a cross-origin request can change device settings while the admin session is active; the attacker does not need credentials, but the administrator must interact with the crafted page. No public exploit code has been identified, EPSS is 0.21% (10th percentile), and the independent assessment rates real-world priority as low despite the 7.0 High CVSS 4.0 base score.
Stored cross-site scripting in Rockwell Automation's 1783-NATR firmware allows an attacker who already holds administrative credentials to the device's web management interface to write malicious script into configuration fields that are neither filtered nor output-encoded, so the payload executes in the browser of any administrator who later loads the affected page - enabling session data to be read or altered or the page to be rendered unusable. Exploitation is network-reachable but gated by the admin login requirement (CVSS 4.0 vector PR:H) and by a victim subsequently viewing the page (UI:P), so it cannot be triggered unauthenticated; there is no public exploit identified at time of analysis and EPSS is low at 0.26% (16th percentile). Although the CVSS 4.0 base score is 8.5, an independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) places real-world urgency much lower, because impact is confined to the browser sessions of management-UI users rather than the device OS itself.
Unauthenticated attackers who can reach the management or critical-function interfaces of a Rockwell Automation 1783-NATR NAT router can trigger functions that perform no authentication check at all, allowing admin account takeover, unauthorized NAT rule modification, or denial of service. The vendor PSIRT rates the flaw 9.9 under CVSS 4.0 (AV:N/PR:N/UI:N, high confidentiality, integrity and availability impact), and our independent CVSS 3.1 assessment scores it C:H/I:H/A:H with scope change; recovery from a successful account takeover is stated to require physical access to the device. No public exploit code has been identified at time of analysis and EPSS is low at 0.54% (44th percentile), so the binding constraint is network exposure rather than exploit availability - the device is an industrial NAT router typically deployed inside segmented OT networks, meaning an attacker must first reach the network segment where the NATR management plane is reachable.
Configuration modification in Rockwell Automation 1783-NATR firmware can be triggered by a remote attacker who convinces an authenticated administrator to visit a crafted link. The affected form lacks a CSRF token, so a cross-origin request can change device settings while the admin session is active; the attacker does not need credentials, but the administrator must interact with the crafted page. No public exploit code has been identified, EPSS is 0.21% (10th percentile), and the independent assessment rates real-world priority as low despite the 7.0 High CVSS 4.0 base score.
Stored cross-site scripting in Rockwell Automation's 1783-NATR firmware allows an attacker who already holds administrative credentials to the device's web management interface to write malicious script into configuration fields that are neither filtered nor output-encoded, so the payload executes in the browser of any administrator who later loads the affected page - enabling session data to be read or altered or the page to be rendered unusable. Exploitation is network-reachable but gated by the admin login requirement (CVSS 4.0 vector PR:H) and by a victim subsequently viewing the page (UI:P), so it cannot be triggered unauthenticated; there is no public exploit identified at time of analysis and EPSS is low at 0.26% (16th percentile). Although the CVSS 4.0 base score is 8.5, an independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) places real-world urgency much lower, because impact is confined to the browser sessions of management-UI users rather than the device OS itself.
Unauthenticated attackers who can reach the management or critical-function interfaces of a Rockwell Automation 1783-NATR NAT router can trigger functions that perform no authentication check at all, allowing admin account takeover, unauthorized NAT rule modification, or denial of service. The vendor PSIRT rates the flaw 9.9 under CVSS 4.0 (AV:N/PR:N/UI:N, high confidentiality, integrity and availability impact), and our independent CVSS 3.1 assessment scores it C:H/I:H/A:H with scope change; recovery from a successful account takeover is stated to require physical access to the device. No public exploit code has been identified at time of analysis and EPSS is low at 0.54% (44th percentile), so the binding constraint is network exposure rather than exploit availability - the device is an industrial NAT router typically deployed inside segmented OT networks, meaning an attacker must first reach the network segment where the NATR management plane is reachable.