CVE-2019-10955 - In Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and earlier, MicroLogix 1100 Controllers v14.00 and earlier, CompactLogix 5370 L1 controllers v30.014 and earlier, CompactLogix 5370 L2 controllers v30.014 and earlier, CompactLogix 5370 L3 controllers (includes CompactLogix GuardLogix controllers) v30.014 and earlier, an open redirect vulnerability could allow a remote unauthenticated attacker to input a malicious link to redirect users to a malicious site that could run or download arbitrary malware on the user’s machine

Back Back to CVE browser

MEDIUM

In Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and earlier, MicroLogix 1100 Controllers v14.00 and earlier, CompactLogix 5370 L1 controllers v30.014 and earlier, CompactLogix 5370 L2 controllers v30.014 and earlier, CompactLogix 5370 L3 controllers (includes CompactLogix GuardLogix controllers) v30.014 and earlier, an open redirect vulnerability could allow a remote unauthenticated attacker to input a malicious link to redirect users to a malicious site that could run or download arbitrary malware on the user’s machine

Published Apr 25, 2019

6.1

MEDIUM

CVSS 3.1

EPSS 3.06%

Description

In Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and earlier, MicroLogix 1100 Controllers v14.00 and earlier, CompactLogix 5370 L1 controllers v30.014 and earlier, CompactLogix 5370 L2 controllers v30.014 and earlier, CompactLogix 5370 L3 controllers (includes CompactLogix GuardLogix controllers) v30.014 and earlier, an open redirect vulnerability could allow a remote unauthenticated attacker to input a malicious link to redirect users to a malicious site that could run or download arbitrary malware on the user’s machine.

Affected products

Vendor Rockwell Automation Product CompactLogix 5370 L1 controllers Default
unknown
Affected
- v30.014 and earlier
Vendor Rockwell Automation Product CompactLogix 5370 L2 controllers Default
unknown
Affected
- v30.014 and earlier
Vendor Rockwell Automation Product CompactLogix 5370 L3 controllers Default
unknown
Affected
- v30.014 and earlier
Vendor Rockwell Automation Product MicroLogix 1100 Controllers Default
unknown
Affected
- v14.00 and earlier
Vendor Rockwell Automation Product MicroLogix 1400 Controllers Default
unknown
Affected
- All Versions Series B
- Series A
- v15.002 and earlier

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Rockwell Automation	CompactLogix 5370 L1 controllers	unknown	Affected v30.014 and earlier
Rockwell Automation	CompactLogix 5370 L2 controllers	unknown	Affected v30.014 and earlier
Rockwell Automation	CompactLogix 5370 L3 controllers	unknown	Affected v30.014 and earlier
Rockwell Automation	MicroLogix 1100 Controllers	unknown	Affected v14.00 and earlier
Rockwell Automation	MicroLogix 1400 Controllers	unknown	Affected All Versions Series B Series A v15.002 and earlier

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-601

Open Redirect

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2669
Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-19-113-01
x_refsource_MISCThird Party AdvisoryUS Government Resource
https://www.securityfocus.com/bid/108049
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2669		Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-19-113-01		x_refsource_MISCThird Party AdvisoryUS Government Resource
https://www.securityfocus.com/bid/108049		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner icscert

Published Apr 25, 2019

Updated Jun 3, 2026

Reserved Apr 8, 2019

Link CVE-2019-10955

CISA Vulnrichment

Updated Jun 3, 2026

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-10955

Red Hat

No data

ENISA EUVD

Assigner icscert

Published Apr 25, 2019

Updated Jun 3, 2026

Link EUVD-2019-2669

GitHub

No data