Rockwell Automation Armor PowerFlex Vulnerable to Denial-Of-Service

published 2023-08-08 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-33912

cvss: 8.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits: 0; none known

A vulnerability was discovered in the Rockwell Automation Armor PowerFlex device when the product sends communications to the local event log. Threat actors could exploit this vulnerability by sending an influx of network commands, causing the product to generate an influx of event log traffic at a high rate. If exploited, the product would stop normal operations and self-reset creating a denial-of-service condition. The error code would need to be cleared prior to resuming normal operations.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-23-227-02 updated 2023-08-15 cvss 7.5

Rockwell Automation Armor PowerFlex

Rockwell Automation Armor PowerFlex v1.003
affected: fixed in v2.001, mitigation “Rockwell Automation recommends users apply the following mitigations:” compatibility.rockwellautomation.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-10-11)

Exploit prediction

1.20% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Rockwell Automation Armor PowerFlex
rockwellautomation armor_powerflex

Classification

Weakness

CWE-682 Incorrect Calculation

References

rockwellautomation.custhelp.com /app/answers/answer_view/a_id/1140371
permissions-required

Sources

CVE List CVE-2023-2423
NVD CVE-2023-2423

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary