Lucene search

K
cve[email protected]CVE-2024-4609
HistoryMay 16, 2024 - 4:15 p.m.

CVE-2024-4609

2024-05-1616:15:10
CWE-20
web.nvd.nist.gov
27
rockwell automation
factorytalk view se
sql injection
information exposure
data modification
data deletion

7.1 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

A vulnerability exists in the Rockwell Automation FactoryTalk® View SE Datalog function that could allow a threat actor to inject a malicious SQL statement if the SQL database has no authentication in place or if legitimate credentials were stolen. If exploited, the attack could result in information exposure, revealing sensitive information. Additionally, a threat actor could potentially modify and delete the data in a remote database. An attack would only affect the HMI design time, not runtime.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "FactoryTalk® View SE",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "status": "affected",
        "version": "<14"
      }
    ]
  }
]

7.1 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

Related for CVE-2024-4609