Summary
Ein Angreifer kann mehrere Schwachstellen in verschiedenen Rockwell Automation FactoryTalk Komponenten ausnutzen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um seine Privilegien zu erhöhen.
Product
FactoryTalk ist eine Software für die industrielle Automatisierung, die zur Maximierung der Effizienz und Steigerung der Anlagenproduktivität entwickelt wurde.
Vulnerabilities 4
-
High 8.8
Tenda FH1202 webExcptypemanFilter fromwebExcptypemanFilter stack-based overflow
A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. This vulnerability affects the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. The manipulation of the argument page leads to stack-based buff…
-
High 8.5
Rockwell Automation FactoryTalk® ViewPoint Privilege Escalation Vulnerability
A security issue exists in FactoryTalk ViewPoint version 14.0 or below due to improper handling of MSI repair operations. During a repair, attackers can hijack the cscript.exe console window, which runs with SYSTEM privileges. This can be exploited to spawn a…
-
High 8.5
Rockwell Automation FactoryTalk® Action Manager v1.0.0 Runtime Vulnerability
A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token. This token is broadcasted over a WebSocket and can be intercepted by any local client listening on the connection.
-
High 8.4
Rockwell Automation FactoryTalk® Linx Network Browser Security Bypass Vulnerability
A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to ‘development’, the attacker can disable FTSP token validation. This bypass allows access to create, update, and delete FTLinx drivers.
Revision history
-
#1
Initiale Fassung
References
-
Rockwell Security Advisory SD1735 vom 2025-08-14
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1735.html
-
Rockwell Security Advisory SD1738 vom 2025-08-14
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1738.html
-
Rockwell Security Advisory SD1740 vom 2025-08-14
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1740.html