CVE-2023-2071: FactoryTalk View Machine Edition Vulnerable to Remote Code Execution
First published: Tue Sep 12 2023(Updated: )
Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve remote code executed via crafted malicious packets. The device has the functionality, through a CIP class, to execute exported functions from libraries. There is a routine that restricts it to execute specific functions from two dynamic link library files. By using a CIP class, an attacker can upload a self-made library to the device which allows the attacker to bypass the security check and execute any code written in the function.
Credit: PSIRT@rockwellautomation.com PSIRT@rockwellautomation.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rockwellautomation Factorytalk View | <=13.0 | |
| Rockwellautomation Panelview Plus |
Remedy
* Install the security patches for the respective versions referencing BF29493 - Patch: FactoryTalk Linx CIP Vulnerability issue, FactoryTalk View ME 12.0, 13.0 https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139946 .
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-2071?
CVE-2023-2071 is a vulnerability in Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, which allows unauthenticated attackers to achieve remote code execution via crafted malicious packets.
What is the severity of CVE-2023-2071?
The severity of CVE-2023-2071 is critical with a score of 9.8.
Which software versions are affected by CVE-2023-2071?
Rockwell Automation FactoryTalk View Machine Edition versions up to and including 13.0 are affected by CVE-2023-2071.
How can an unauthenticated attacker exploit CVE-2023-2071?
An unauthenticated attacker can exploit CVE-2023-2071 by sending crafted malicious packets to the vulnerable device.
Is Rockwell Automation PanelView Plus affected by CVE-2023-2071?
No, Rockwell Automation PanelView Plus is not affected by CVE-2023-2071.
- collector/nvd-api
- collector/nvd-index
- agent/weakness
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/title
- agent/references
- agent/first-publish-date
- agent/event
- agent/description
- agent/tags
- vendor/rockwellautomation
- canonical/rockwellautomation factorytalk view
- version/rockwellautomation factorytalk view/13.0
- canonical/rockwellautomation panelview plus