CVE-2019-13524

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-16 · updated 2026-06-17
Weakness: CWE-20

Description

GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versions(End of Life) may allow an attacker sending specially manipulated packets to cause the module state to change to halt-mode, resulting in a denial-of-service condition. An operator must reboot the CPU module after removing battery or energy pack to recover from halt-mode.

Affected products

Emerson Rx3I Cpe100 Firmware: before r9.85 — fixed in r9.85
Emerson Rx3I Cpe115 Firmware: before r9.85 — fixed in r9.85
Emerson Rx3I Cpe302 Firmware: before r9.90 — fixed in r9.90
Emerson Rx3I Cpe305 Firmware: before r9.90 — fixed in r9.90
Emerson Rx3I Cpe310 Firmware: before r9.90 — fixed in r9.90
Emerson Rx3I Cpe330 Firmware: before r9.90 — fixed in r9.90
Emerson Rx3I Cpe400 Firmware: before r9.90 — fixed in r9.90
Emerson Rx3I Cpl410 Firmware: before r9.90 — fixed in r9.90
Emerson Rx3I Cru320 Firmware: all versions

How to fix

Upgrade to a fixed version: Emerson Rx3I Cpe100 Firmware r9.85; Emerson Rx3I Cpe115 Firmware r9.85; Emerson Rx3I Cpe302 Firmware r9.90; Emerson Rx3I Cpe305 Firmware r9.90; Emerson Rx3I Cpe310 Firmware r9.90; Emerson Rx3I Cpe330 Firmware r9.90; Emerson Rx3I Cpe400 Firmware r9.90; Emerson Rx3I Cpl410 Firmware r9.90. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-13524 or the next vulnerability affects your stack