Summary
Ein Angreifer kann mehrere Schwachstellen in Rockwell Automation FactoryTalk ausnutzen, um Informationen offenzulegen, Daten zu manipulieren und beliebigen Code auszuführen.
Product
FactoryTalk ist eine Software für die industrielle Automatisierung, die zur Maximierung der Effizienz und Steigerung der Anlagenproduktivität entwickelt wurde.
Vulnerabilities 3
-
High 8.7
Rockwell Automation FactoryTalk Activation Manager Lack of Encryption Vulnerability
A security issue exists within FactoryTalk Activation Manager. An error in the implementation of cryptography within the software could allow attackers to decrypt traffic. This could result in data exposure, session hijacking, or full communication compromise.
-
High 8.7
Rockwell Automation FactoryTalk® Analytics™ LogixAI® Exposed Redis DB
An open database issue exists in the affected product and version. The security issue stems from an over permissive Redis instance. This could result in an attacker on the intranet accessing sensitive data and potential alteration of data.
-
High 7.3
Rockwell Automation FactoryTalk Optix Remote Code Execution Vulnerability
A security issue exists within FactoryTalk Optix MQTT broker due to the lack of URI sanitization. This flaw enables the loading of remote Mosquito plugins, which can be used to achieve remote code execution.
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2025-27250, EUVD-2025-27251, EUVD-2025-27247
-
#1
Initiale Fassung
References
-
Rockwell Security Advisory vom 2025-09-08
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1741.html
-
Rockwell Security Advisory vom 2025-09-08
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1742.html
-
Rockwell Security Advisory vom 2025-09-08
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1748.html