Описание
All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. A remote, unauthenticated attacker may be able to execute a crafted file on a remote endpoint that may result in remote code execution (RCE). Rockwell Automation recommends applying patch 1126289. Before installing this patch, the patch rollup dated 06 Apr 2020 or later MUST be applied. 1066644 – Patch Roll-up for CPR9 SRx.
Ссылки
- ExploitThird Party AdvisoryVDB Entry
- Vendor Advisory
- Third Party AdvisoryUS Government Resource
- ExploitThird Party AdvisoryVDB Entry
- Vendor Advisory
- Third Party AdvisoryUS Government Resource
Уязвимые конфигурации
EPSS
9 Critical
CVSS3
7.8 High
CVSS3
6.8 Medium
CVSS2
Дефекты
Связанные уязвимости
All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. A remote, unauthenticated attacker may be able to execute a crafted file on a remote endpoint that may result in remote code execution (RCE). Rockwell Automation recommends applying patch 1126289. Before installing this patch, the patch rollup dated 06 Apr 2020 or later MUST be applied. 1066644 – Patch Roll-up for CPR9 SRx.
Уязвимость программного средства управления человеко-машинными интерфейсами (HMI) Rockwell Automation FactoryTalk View SE, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
EPSS
9 Critical
CVSS3
7.8 High
CVSS3
6.8 Medium
CVSS2