Rockwell Automation FactoryTalk View Site Edition (Update A)

Summary

Vulnerabilities 1

• High 8.5
  CVE-2024-7513

  Rockwell Automation FactoryTalk® View Site Edition Code Execution Vulnerability via File Permissions

  CVE-2024-7513 IMPACT A code execution vulnerability exists in the affected product. The vulnerability occurs due to improper default file permissions allowing any user to edit or replace files, which are executed by account with elevated permissions.

  Rockwell Automation FactoryTalk® View Site Edition ICS / OT
  Aug 14, 2024

Revision history

1. 2024-08-29 #2

   Update A - Changed mitigation information.

2. 2024-08-13 #1

   Initial Publication

References

• ICSA Advisory ICSA-24-226-06 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-06
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014