CVE-2022-3158

2022-10-1700:00:00

CWE-89

Rockwell

www.cve.org

rockwell automation

factorytalk vantagepoint

sql server

input validation

remote code execution

cve-2022-3158

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.1%

JSON

Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an input validation vulnerability. The FactoryTalk VantagePoint SQL Server lacks input validation when users enter SQL statements to retrieve information from the back-end database. If successfully exploited, this could allow a user with basic user privileges to perform remote code execution on the server.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "FactoryTalk VantagePoint",
    "versions": [
      {
        "version": "8.0, 8.10, 8.20, 8.30, 8.31",
        "status": "affected"
      }
    ]
  }
]