Design/Logic Flaw

Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an attacker to link to or run a malicious executable. This may allow an authorized, but not privileged local user to execute arbitrary code wi...

CVE-2017-6015

Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an attacker to link to or run a malicious executable. This may allow an authorized, but not privileged local user to execute arbitrary code wi...

CVE-2017-6015

Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an attacker to link to or run a malicious executable. This may allow an authorized, but not privileged local user to execute arbitrary code wi...

CVE-2017-6015

Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an attacker to link to or run a malicious executable. This may allow an authorized, but not privileged local user to execute arbitrary code wi...

CVE-2017-6015

CVE-2017-6015 affects Rockwell Automation FactoryTalk Activation, specifically the Activation Service prior to version 4.01.00. The root cause is an unquoted whitespace in file paths, which can let a local, authenticated user link to or execute a malicious executable, granting elevated privileges...

Rockwell Automation FactoryTalk Activation Manager (Update B)

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : Rockwell Automation Equipment : Factory Talk Activation Manager Vulnerabilities : Cross-site Scripting, Improper Restriction of Operations within the Bounds of a Memory Buffer 2. UPDATE...

CVE-2017-14022

An Improper Input Validation issue was discovered in Rockwell Automation FactoryTalk Alarms and Events, Version 2.90 and earlier. An unauthenticated attacker with remote access to a network with FactoryTalk Alarms and Events can send a specially crafted set of packets packet to Port 403/TCP the...

CVE-2017-14022

An Improper Input Validation issue was discovered in Rockwell Automation FactoryTalk Alarms and Events, Version 2.90 and earlier. An unauthenticated attacker with remote access to a network with FactoryTalk Alarms and Events can send a specially crafted set of packets packet to Port 403/TCP the...

Input validation

An Improper Input Validation issue was discovered in Rockwell Automation FactoryTalk Alarms and Events, Version 2.90 and earlier. An unauthenticated attacker with remote access to a network with FactoryTalk Alarms and Events can send a specially crafted set of packets packet to Port 403/TCP the...

CVE-2017-14022

Rockwell Automation FactoryTalk Alarms and Events (v2.90 and earlier) suffers an Improper Input Validation (CWE-20). An unauthenticated attacker with remote access can send specially crafted packets to Port 403/TCP (History Archiver service), causing the history archiver to stall or terminate. Af...

CVE-2017-14022

An Improper Input Validation issue was discovered in Rockwell Automation FactoryTalk Alarms and Events, Version 2.90 and earlier. An unauthenticated attacker with remote access to a network with FactoryTalk Alarms and Events can send a specially crafted set of packets packet to Port 403/TCP the...

Rockwell Automation FactoryTalk Alarms and Events Denial of Service Vulnerability

Rockwell Automation is a solutions provider for industrial automation, control and information technology. A denial of service vulnerability exists in Rockwell Automation FactoryTalk Alarms and Events. An unauthenticated attacker using FactoryTalk Alarms and Events to remotely access the network...

Rockwell Automation FactoryTalk Alarms and Events

CVSS v3 7.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Rockwell Automation Equipment: FactoryTalk Alarms and Events Vulnerability: Improper Input Validation AFFECTED PRODUCTS The following versions of FactoryTalk Alarms and Events, a component of the Factory Talk Services...

Rockwell Automation FactoryTalk Activation Local Elevation of Privilege Vulnerability

Rockwell Automation is a solutions provider for industrial automation, control and information technology. A local elevation of privilege vulnerability exists in Rockwell Automation FactoryTalk Activation. A local attacker can exploit the vulnerability to execute arbitrary code with SYSTEM...

Rockwell Automation FactoryTalk Activation

CVSS v3 8.8 REPOSTED INFORMATION This advisory was originally posted to the NCCIC Portal on February 16, 2017, and is being released to the ICS-CERT web site. AFFECTED PRODUCTS The following versions of FactoryTalk Activation, a component of FactoryTalk Services Platform, are affected: FactoryTal...

Rockwell Automation FactoryTalk EnergyMetrix Elevation of Privilege Vulnerability

Rockwell Automation FactoryTalk EnergyMetrix is a Web-based software management package for capturing, analyzing, storing and sharing energy data from Rockwell Automation. A security vulnerability exists in Rockwell Automation FactoryTalk EnergyMetrix versions prior to 2.20.00, which can be...

CVE-2016-4531

Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

CVE-2016-4522

SQL injection vulnerability in Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-4522

SQL injection vulnerability in Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Design/Logic Flaw

Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...