An HTTP PUT That Takes Down a Motor Starter
CISA's ArmorStart LT advisory pairs a stored cross-site scripting flaw with an unthrottled resource allocation reachable by HTTP PUT, scoring 8.7 on CVSS v4. Firmware v2.002 corrects both.
CISA released ICSA-26-246-04 on 3 September covering Rockwell Automation's ArmorStart LT at version 2.001 and earlier. Two issues are listed. CVE-2026-19471 is a stored cross-site scripting flaw in the embedded web server, CWE-79, scored 7.3 on CVSS v3.1 and 6.9 on v4.0: an attacker can inject a script that executes when another user opens the affected page. CVE-2026-19472 is an allocation of resources without limits or throttling, CWE-770, triggered by HTTP PUT requests and scored 7.5 on v3.1 but 8.7 on v4.0, causing loss of web server availability. Both are corrected in firmware v2.002, and users who cannot upgrade are directed to Rockwell's security best practices.
The ArmorStart LT is a distributed motor starter — a drive and starter package mounted on the machine rather than in a central cabinet, which is the whole point of the product and also the reason this advisory deserves more attention than its scores suggest. Distributed devices are numerous, physically scattered across a plant, and connected to the same machine network as everything else. A flaw in one is a flaw in dozens, and firmware updates on dozens of devices bolted to conveyors and skids are a different logistical problem from updating one controller in a cabinet.
The gap between the two CVSS scores on the second issue is also worth reading rather than skipping. Version 4.0 scores it higher than 3.1 does, and that is the newer framework doing what it was designed to do: weighting an availability impact on a device whose availability is the product. A denial of service against a web interface on an office server is an inconvenience; the same flaw on a motor starter's embedded server is the diagnostic and configuration path to a device controlling a motor, lost at exactly the moment someone is trying to work out why the line stopped.
The practical guidance follows from what these devices are. Inventory them properly — distributed starters are among the most commonly missing entries in an OT asset register, because they were installed as part of a machine rather than procured as network devices. Plan the firmware campaign around machine availability rather than treating it as an IT patch cycle. And consider whether the embedded web server needs to be reachable at all: on most installations it is used during commissioning and then never again, which makes restricting it to an engineering VLAN a change with no operational cost and a permanent reduction in exposure.