Lucene search

K
cve[email protected]CVE-2024-4609
HistoryMay 16, 2024 - 4:15 p.m.

CVE-2024-4609

2024-05-1616:15:10
CWE-20
web.nvd.nist.gov
27
rockwell automation
factorytalk view se
sql injection
information exposure
data modification
data deletion

8.8 High

CVSS4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:L/SI:N/VA:L/SA:N

7.1 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

A vulnerability exists in the Rockwell Automation FactoryTalk® View SE Datalog function that could allow a threat actor to inject a malicious SQL statement if the SQL database has no authentication in place or if legitimate credentials were stolen. If exploited, the attack could result in information exposure, revealing sensitive information. Additionally, a threat actor could potentially modify and delete the data in a remote database. An attack would only affect the HMI design time, not runtime.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "FactoryTalk® View SE",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "status": "affected",
        "version": "<14"
      }
    ]
  }
]

8.8 High

CVSS4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:L/SI:N/VA:L/SA:N

7.1 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

Related for CVE-2024-4609