CVE-2023-46289: Rockwell Automation FactoryTalk® View Site Edition Vulnerable to Improper Input Validation
First published: Fri Oct 27 2023(Updated: )
Rockwell Automation FactoryTalk View Site Edition insufficiently validates user input, which could potentially allow threat actors to send malicious data bringing the product offline. If exploited, the product would become unavailable and require a restart to recover resulting in a denial-of-service condition.
Credit: PSIRT@rockwellautomation.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| >=11.0<=13.0 |
Remedy
* Install the patch that remediates the issue: BF29581 - Patch: External Service Interaction (HTTP), FactoryTalk View SE 11.0, 12.0 13.0 https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140243 .
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-46289?
CVE-2023-46289 is a vulnerability in Rockwell Automation FactoryTalk View Site Edition that allows threat actors to send malicious data, potentially causing the product to become unavailable and requiring a restart to recover.
How does CVE-2023-46289 affect Rockwell Automation FactoryTalk View Site Edition?
CVE-2023-46289 affects Rockwell Automation FactoryTalk View Site Edition by insufficiently validating user input, which can allow threat actors to send malicious data and bring the product offline.
What is the severity of CVE-2023-46289?
CVE-2023-46289 has a severity rating of 7.5 (high).
What is the Common Weakness Enumeration (CWE) ID of CVE-2023-46289?
The Common Weakness Enumeration (CWE) ID of CVE-2023-46289 is 20.
How can I fix CVE-2023-46289 in Rockwell Automation FactoryTalk View Site Edition?
To fix CVE-2023-46289 in Rockwell Automation FactoryTalk View Site Edition, ensure you have the latest version installed, as updates may include patches for this vulnerability. Additionally, follow the recommendations provided by the vendor.
- collector/mitre-cve
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/weakness
- agent/title
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/severity
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- vendor/rockwellautomation
- canonical/rockwellautomation factorytalk view
- version/rockwellautomation factorytalk view/11.0
- version/rockwellautomation factorytalk view/13.0