Critical XSS and DoS Vulnerabilities Found in Rockwell ArmorStart LT Industrial Controllers
Rockwell Automation's ArmorStart LT motor controllers contained two critical firmware vulnerabilities — a stored XSS flaw and an improper HTTP PUT request handler — that could allow attackers to inject malicious scripts or disrupt operations entirely. These vulnerabilities are especially dangerous in operational technology (OT) environments where availability and integrity are mission-critical. The root issue lies in insufficient input validation and improper HTTP method handling within the device firmware. Because industrial control devices often run for years without updates, unpatched firmware represents a significant attack surface in manufacturing and critical infrastructure environments. Rockwell's release of v2.002 addresses both flaws, but organizations must act quickly to apply the fix before threat actors exploit these known vulnerabilities.
Tactical Insight
Immediate actions
- Upgrade all affected ArmorStart LT devices to firmware version v2.002 immediately.
- Audit your OT/ICS asset inventory to identify all devices running vulnerable firmware versions (v2.001 and below).
- Restrict network access to ArmorStart LT web interfaces using firewall rules or ACLs pending patching.
Long-term improvements
- Establish a formal OT/ICS patch management program with defined SLAs for critical vulnerability remediation.
- Implement network segmentation to isolate industrial control systems from corporate IT networks and the public internet.
- Integrate industrial device firmware into a continuous vulnerability management program using ICS-aware scanning tools.
Detection measures
- Enable logging of HTTP PUT requests and abnormal web interface activity on OT network monitoring tools.
- Deploy an ICS-aware intrusion detection system (IDS) such as Claroty, Dragos, or Nozomi to monitor for XSS payload patterns and DoS anomalies.
- Establish alerting thresholds for unusual traffic volumes targeting motor controller management interfaces.