Summary
Ein Angreifer kann mehrere Schwachstellen in Rockwell Automation FactoryTalk View ME und FactoryTalk Updater ausnutzen, um Sicherheitsvorkehrungen zu umgehen, seine Rechte zu erweitern, Informationen offenzulegen oder Code auszuführen.
Product
FactoryTalk ist eine Software für die industrielle Automatisierung, die zur Maximierung der Effizienz und Steigerung der Anlagenproduktivität entwickelt wurde.
Vulnerabilities 4
-
Critical 9.1
FactoryTalk® Updater Authentication Bypass
An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts and could allow a threat actor to impersonate a user if the threat actor is able to enumerate additional information required…
-
High 8.4
FactoryTalk® Updater Remote Code Execution
A Remote Code Execution vulnerability exists in the affected product. The vulnerability requires a high level of permissions and exists due to improper input validation resulting in the possibility of a malicious Updated Agent being deployed.
-
High 7.3
FactoryTalk® Updater Local Privilege Escalation
A Local Privilege Escalation vulnerability exists in the affected product. The vulnerability requires a local, low privileged threat actor to replace certain files during update and exists due to a failure to perform proper security checks before installation.
-
High 7.3
FactoryTalk View ME Remote Code Execution Vulnerability via Project Save Path
A remote code execution vulnerability exists in the affected product. The vulnerability allows users to save projects within the public directory allowing anyone with local access to modify and/or delete files. Additionally, a malicious user could potentially…
Revision history
-
#1
Initiale Fassung
References
-
Rockwell Automation Security Advisory SD 1709 vom 2024-11-12
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201709.html
-
Rockwell Automation Security Advisory SD 1710 vom 2024-11-12
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201710.html