CVE-2019-13524 Denial of service in GE PACSystems RX3i
An attacker can send manipulated packets to halt the CPU module, causing a denial of service that requires a physical reboot to recover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-13524?
CVE-2019-13524 is a high-severity denial of service vulnerability in GE PACSystems RX3i, published on 16 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versions(End of Life) may allow an attacker sending specially manipulated packets to cause the module state to change to halt-mode, resulting in a denial-of-service condition. An operator must reboot the CPU module after removing battery or energy pack to recover from halt-mode.
Weakness: CWE-20
Which versions are affected by CVE-2019-13524?
It affects 9 products.
Products include Emerson Rx3i Cpe100 Firmware, Emerson Rx3i Cpe115 Firmware, Emerson Rx3i Cpe302 Firmware, Emerson Rx3i Cpe305 Firmware, Emerson Rx3i Cpe310 Firmware, Emerson Rx3i Cpe330 Firmware and 3 more.
How do I fix CVE-2019-13524?
No fix has been published for CVE-2019-13524 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-13524 being exploited?
There is no known exploitation of CVE-2019-13524 in the wild and no public exploit code.
Sources
Also known as GHSA-rvgf-qg2w-7jr4.