CVE-2019-25276: Studio 5000 Logix Designer 30.01.00 - 'FactoryTalk Activation Service' Unquoted Service Path
Studio 5000 Logix Designer 30.01.00 contains an unquoted service path vulnerability in the FactoryTalk Activation Service that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Rockwell Software\FactoryTalk Activation\ to inject malicious code that would execute with LocalSystem permissions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25276?
CVE-2019-25276 is considered to have a medium severity due to its potential for local users to gain elevated privileges.
How do I fix CVE-2019-25276?
To fix CVE-2019-25276, ensure that the service path for the FactoryTalk Activation Service is properly quoted.
Who is affected by CVE-2019-25276?
CVE-2019-25276 affects users of Rockwell Automation Studio 5000 Logix Designer version 30.01.00.
Can CVE-2019-25276 be exploited remotely?
CVE-2019-25276 cannot be exploited remotely and requires local access to the affected system.
What are the potential impacts of CVE-2019-25276?
The potential impacts of CVE-2019-25276 include unauthorized code execution with elevated privileges on the affected system.