CVE-2026-19471 Overview
CVE-2026-19471 documents multiple stored cross-site scripting (XSS) vulnerabilities in Rockwell Automation ArmorStart® LT. The device fails to properly sanitize user-supplied input before storing it on the server. An attacker can inject malicious JavaScript that executes when other users load the affected page.
The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Exploitation is network-accessible and requires no authentication or user interaction. Rockwell Automation published details in Security Advisory SD1797.
Critical Impact
Attackers can persist malicious scripts in the ArmorStart® LT web interface, hijack operator sessions, and pivot within industrial control networks that expose the device management page.
Affected Products
- Rockwell Automation ArmorStart® LT (see vendor advisory SD1797 for firmware versions)
Discovery Timeline
- 2026-09-01 - CVE-2026-19471 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-19471
Vulnerability Analysis
Stored cross-site scripting occurs when an application accepts attacker-controlled input, persists it, and later renders it in a response without proper encoding. In ArmorStart® LT, multiple input fields in the device's web interface fail to enforce output encoding or input validation.
An attacker submits crafted input containing HTML or JavaScript through the affected fields. The payload is written to persistent storage on the device. When an operator or administrator visits the affected page, the browser parses the attacker's script in the context of the ArmorStart® LT origin.
Because the script runs with the victim's session, it can read session tokens, modify device configuration through authenticated requests, and stage further attacks against the operational technology (OT) network.
Root Cause
The root cause is missing neutralization of special characters in user input before it is stored and rendered. The affected endpoints do not apply HTML entity encoding on output and do not validate input against an allowlist. This maps directly to [CWE-79].
Attack Vector
The attack vector is network-based. An unauthenticated attacker with reachability to the ArmorStart® LT web interface submits a request containing an XSS payload to a vulnerable field. The payload persists and executes for any subsequent user who views the injected content. No user interaction is required to plant the payload, though a victim must load the page for execution.
No public exploit code or proof-of-concept has been published. See the Rockwell Automation SD1797 advisory for vendor technical details.
Detection Methods for CVE-2026-19471
Indicators of Compromise
- HTTP POST or PUT requests to ArmorStart® LT web endpoints containing <script>, onerror=, onload=, or javascript: substrings in field values.
- Stored configuration or label fields on the device rendering unexpected HTML tags when viewed in a browser.
- Outbound HTTP requests from operator workstations to unfamiliar domains immediately after loading the device management page.
Detection Strategies
- Inspect web traffic to and from ArmorStart® LT devices for HTML and JavaScript tokens in request bodies and query parameters.
- Baseline expected configuration field content and alert on values containing angle brackets, event handlers, or URL-encoded script fragments.
- Correlate device configuration changes with the source IP and user agent that submitted the change.
Monitoring Recommendations
- Forward ArmorStart® LT web server logs and network flow records to a centralized analytics platform for retention and correlation.
- Monitor operator browser sessions for anomalous script execution or DOM modification when loading device pages.
- Alert on any access to ArmorStart® LT management interfaces originating from outside the designated OT engineering VLAN.
How to Mitigate CVE-2026-19471
Immediate Actions Required
- Restrict network access to the ArmorStart® LT web interface using firewall rules and OT segmentation. Only engineering workstations should reach the management port.
- Review stored configuration fields for injected HTML or script content and remove any unexpected values.
- Rotate credentials for accounts that have logged into affected devices while the vulnerability was exposed.
Patch Information
Apply the firmware update referenced in Rockwell Automation Security Advisory SD1797. Follow Rockwell's guidance for validating firmware integrity before deployment to production controllers.
Workarounds
- Place ArmorStart® LT devices behind a jump host or bastion that terminates and inspects HTTP sessions.
- Disable or restrict the web management interface where operational requirements permit CLI or engineering-tool-only administration.
- Enforce browser-level content filtering on engineering workstations to block execution of scripts from device management origins that are not on an allowlist.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.