What is CVE-2018-19282?

CVE-2018-19282 is a critical-severity vulnerability in Rockwellautomation Powerflex 525 Ac Drives, classified under Uncontrolled Resource Consumption. CVSS score: 9.8/10. Published 2019-04-04.

How severe is CVE-2018-19282?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Resource exhaustion in Rockwellautomation Powerflex 525 Ac Drives

CVE-2018-19282

Rockwell Automation PowerFlex 525 AC Drives 5.001 and earlier allow remote attackers to cause a denial of service by crashing the Common Industrial Protocol (CIP) network stack. The vulnerability allows the attacker to crash the CIP in a way that it does not accept new connections, but keeps the current connections active, which can prevent legitimate users from recovering control.

Vulnerability class: DoS (Denial of Service)

EPSS: 0.056 (92.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Rockwellautomation Powerflex_525_ac_drives
Rockwellautomation Powerflex_525_ac_drives_firmware
N/a — versions n/a

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

cve@mitre.org (US Government Resource, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-19282?: CVE-2018-19282 is a critical-severity vulnerability in Rockwellautomation Powerflex 525 Ac Drives, classified under Uncontrolled Resource Consumption. CVSS score: 9.8/10. Published 2019-04-04.
How severe is CVE-2018-19282?: Critical severity. CVSS v3 base score is 9.8 out of 10.