CVE-2024-45824
FactoryTalk® View Site Edition Remote Code Execution Vulnerability via Lack of Input Validation
- State
- Published
- Severity
- 9.2 Critical
- Published
- Sep 12, 2024
- Updated
- Sep 12, 2024
- Reserved
- Sep 9, 2024
Description
CVE-2024-45824 IMPACT
A remote code vulnerability exists in the affected products. The vulnerability occurs when chained with Path Traversal, Command Injection, and XSS Vulnerabilities and allows for full unauthenticated remote code execution. The link in the mitigations section below contains patches to fix this issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.2 Critical | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | Rockwell |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Rockwell |
Weaknesses
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected Products
| Product | Versions |
|---|---|
FactoryTalk View Site EditionRockwell Automation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.