CVE-2024-6325

The v6.40 release of Rockwell Automation FactoryTalk® Policy Manager CVE-2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and CVE-2022-1161 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html by...

CVE-2024-6325 Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services

The v6.40 release of Rockwell Automation FactoryTalk® Policy Manager CVE-2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and CVE-2022-1161 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html by...

CVE-2024-6325

CVE-2024-6325 affects Rockwell Automation FactoryTalk System Services and Policy Manager (v6.40). The root cause is improper privilege management that exposes private keys used for certificates/PSKs, enabling a malicious user with machine access to impersonate resources on the secured network. Th...

Rockwell Automation ControlLogix, GuardLogix, and CompactLogix

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.3 ATTENTION : Low attack complexity Vendor : Rockwell Automation Equipment : ControlLogix, GuardLogix, CompactLogix Vulnerability : Always-Incorrect Control Flow Implementation 2. RISK EVALUATION Successful exploitation of this vulnerability could...

Rockwell Automation PowerFlex 527 Input Validation Error Vulnerability

The Rockwell Automation PowerFlex 527 is an adjustable AC frequency converter from Rockwell Automation. The Rockwell Automation PowerFlex 527 has an input validation error vulnerability that can be exploited by an attacker to cause CIP communication to be interrupted, requiring a manual restart...

CVE-2024-2426

A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, a disruption in the CIP communication will occur and a manual restart will be required by the user to recover it...

CVE-2024-2426 Rockwell Automation - Denial-of-service and Input Validation Vulnerabilities in PowerFlex® 527

A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, a disruption in the CIP communication will occur and a manual restart will be required by the user to recover it...

CVE-2024-2426 Rockwell Automation - Denial-of-service and Input Validation Vulnerabilities in PowerFlex® 527

A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, a disruption in the CIP communication will occur and a manual restart will be required by the user to recover it...

CVE-2024-2426

The CVE-2024-2426 entry concerns Rockwell Automation PowerFlex 527, affecting versions v2.001.x and later. The vulnerability is an improper input validation in the device that can cause a denial-of-service by disrupting CIP communication, potentially requiring a manual restart to recover. The iss...

Rockwell Automation PowerFlex 安全漏洞

The Rockwell Automation PowerFlex 527 is an adjustable AC frequency converter from Rockwell Automation. The Rockwell Automation PowerFlex 527 has an input validation error vulnerability that can be exploited by an attacker to cause CIP communication to be interrupted, requiring a manual restart...

VulnCheck KEV: CVE-2023-3595

Where this vulnerability exists in the Rockwell Automation 1756 EN2 and 1756 EN3 ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to...

Privilege escalation

Uncontrolled search path in some IntelR CIP software before version 2.4.10577 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-35769

Uncontrolled search path in some IntelR CIP software before version 2.4.10577 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-35769

CVE-2023-35769 affects Intel CIP software prior to version 2.4.10577. The root cause is an uncontrolled search path, which could allow an authenticated user to escalate privileges via local access. Affected products are Intel CIP software before 2.4.10577. Mitigation: upgrade to version 2.4.10577...

CVE-2023-35769

Uncontrolled search path in some IntelR CIP software before version 2.4.10577 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-35769

Uncontrolled search path in some IntelR CIP software before version 2.4.10577 may allow an authenticated user to potentially enable escalation of privilege via local access...

Intel® CIP Software Advisory

Summary: A potential security vulnerability in some Intel® Computing Improvement Program CIP software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-35769 Description: Uncontrolled search path...

PT-2024-1874 · Intel · Intel Cip

Name of the Vulnerable Software and Affected Versions: IntelR CIP software versions prior to 2.4.10577 Description: The issue is related to an uncontrolled search path in some IntelR CIP software, which may allow an authenticated user to potentially enable escalation of privilege via local access...

Malicious code in tfb-cip-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 32e06870354259889acef36568293e07f1ada3677bafaba74764237fb6fef9d2 The OpenSSF Package Analysis project identified 'tfb-cip-app' @ 7.8.9 npm as malicious. It is considered malicious because: - The package...

Rockwell Automation Select Logix Communication Modules Stack-Based Buffer Overflow (CVE-2023-2262)

A buffer overflow vulnerability exists in the Rockwell Automation select 1756-EN communication devices. If exploited, a threat actor could potentially leverage this vulnerability to perform a remote code execution. To exploit this vulnerability, a threat actor would have to send a maliciously...