CVE-2019-13524: GE/Emerson PACSystems RX3i Remote Denial-of-Service via Crafted Packets

CVE-2019-13524 is a high-severity denial-of-service vulnerability (CWE-20, improper input validation) in GE's (now Emerson's) PACSystems RX3i programmable logic controller CPU modules: a remote attacker who sends a specially manipulated network packet to an affected CPU module can force its state into halt-mode, stopping all control output, and NVD's own Primary analysis confirms the flaw at CVSS v3.1 7.5 (high) — recovering from the halt condition requires an operator to physically pull the module's battery or energy pack and reboot it.

CVE-2019-13524 (CWE-20, improper input validation) affects the CPU modules of GE's PACSystems RX3i programmable automation controller line, now sold under Emerson. NVD's description states: "GE PACSystems RX3i CPE100/115: All versions prior to R9.85, CPE302/305/310/330/400/410: All versions prior to R9.90, CRU/320 All versions (End of Life) may allow an attacker sending specially manipulated packets to cause the module state to change to halt-mode, resulting in a denial-of-service condition. An operator must reboot the CPU module after removing battery or energy pack to recover from halt-mode" (NVD).

CISA's ICS advisory ICSA-20-014-01 credits Jin Kyung Lee and Yeop Chang of South Korea's National Security Research Institute (NSR) with reporting the flaw, and confirms the same plain-language impact: "Sending specially manipulated packets can cause the module state to change to halt-mode, resulting in a denial-of-service condition." The advisory's mitigation guidance recommends minimizing network exposure for control systems, placing them behind firewalls isolated from business networks, and using VPNs for any necessary remote access, alongside Emerson's firmware fix (CISA ICSA-20-014-01).

NVD has completed its own severity analysis for this CVE: the Primary score (source [email protected]) is CVSS v3.1 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting a purely availability-impacting, unauthenticated, network-reachable flaw with no confidentiality or integrity impact (NVD).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.01549 (75.224th percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).

Emerson's remediation is to upgrade affected CPU modules to firmware R9.85 (CPE100/CPE115) or R9.90 (CPE302/305/310/330/400/CPL410); the CRU320 is end of life with no fix, and Emerson recommends migrating it to a CPE330 module. Because recovery from a successful attack requires physically pulling the module's battery pack, operators should treat this as a physical-response incident, not just a software restart, and should isolate RX3i control networks from untrusted traffic in the meantime.

• GE PACSystems RX3i CPE100/115 (pre-R9.85), CPE302/305/310/330/400/410 (pre-R9.90) and CRU/320 (all versions, end of life) may allow an attacker sending specially manipulated packets to cause the module state to change to halt-mode, a denial-of-service condition; an operator must reboot the CPU module after removing its battery or energy pack to recover. — NVD
• Sending specially manipulated packets can cause the module state to change to halt-mode, resulting in a denial-of-service condition; reported by Jin Kyung Lee and Yeop Chang of NSR; mitigation is firewalling and VPN-only remote access alongside the vendor firmware fix. — CISA ICSA-20-014-01
• NVD's own Primary CVSS v3.1 score is 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01549 (75.224th percentile) as of 2026-11-07. — FIRST EPSS