CVE-2024-37368: Rockwell Automation FactoryTalk® View SE v11 Information Leakage Vulnerability via Authentication Restriction

Q: What is the severity of CVE-2024-37368?

CVE-2024-37368 is identified as a high-severity vulnerability due to the lack of proper user authentication.

Q: How do I fix CVE-2024-37368?

To fix CVE-2024-37368, update Rockwell Automation FactoryTalk View SE to the latest version as recommended by the vendor.

Q: What is affected by CVE-2024-37368?

CVE-2024-37368 affects Rockwell Automation FactoryTalk View SE versions 11.0 to 14.0.

Q: Can CVE-2024-37368 be exploited remotely?

Yes, CVE-2024-37368 can be exploited remotely by attackers to access HMI projects without proper authentication.

Q: What impact does CVE-2024-37368 have on user data?

CVE-2024-37368 can lead to unauthorized access to sensitive user data within the HMI projects.

Published Jun 14, 2024

Updated

A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote system with FTView to send a packet to the customer’s server to view an HMI project. Due to the lack of proper authentication, this action is allowed without proper authentication verification.

Affected Software

2 affected components

rockwellautomation Factorytalk View>=11.0<14.0

Rockwell Automation FactoryTalk View SE

Remediation

Information

* Corrected in software version v14.0. * Users using the affected software, who are not able to upgrade to one of the corrected versions, are encouraged to apply security best practices, where possible.    * It is recommended that users enforce proper access controls within the network and segment networks containing sensitive information using IPSec: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1090456 * Security Best Practice https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight s

Event History

Jun 14, 2024

CVE Published

via MITRE·02:30 PM

Data Sourced

via MITRE·02:30 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-37368?

CVE-2024-37368 is identified as a high-severity vulnerability due to the lack of proper user authentication.

How do I fix CVE-2024-37368?

To fix CVE-2024-37368, update Rockwell Automation FactoryTalk View SE to the latest version as recommended by the vendor.

What is affected by CVE-2024-37368?