CVE-2024-37369: Rockwell Automation FactoryTalk® View SE Local Privilege Escalation Vulnerability via Local File Permissions
First published: Fri Jun 14 2024(Updated: )
A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassing Access Control Lists, and potentially gaining further access within the system.
Credit: PSIRT@rockwellautomation.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rockwell Automation FactoryTalk View SE | ||
| FactoryTalk View | >=12.0<14.0 |
Remedy
AFFECTED PRODUCTS AND SOLUTION Affected Product First Known in software version Corrected in software version FactoryTalk® View SE V12.0 v14 Mitigations and Workarounds Users using the affected software, who are not able to upgrade to one of the corrected versions, are encouraged to apply security best practices, where possible. * Use the Secure Install option when installing FactoryTalk® Services Platform. * Security Best Practices https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-37369?
The severity of CVE-2024-37369 is critical as it allows low-privilege users to bypass Access Control Lists.
How do I fix CVE-2024-37369?
To fix CVE-2024-37369, upgrade Rockwell Automation FactoryTalk View SE to a version above 14.0.
Who is affected by CVE-2024-37369?
CVE-2024-37369 affects users of Rockwell Automation FactoryTalk View SE versions between 12.0 and 14.0.
What type of vulnerability is CVE-2024-37369?
CVE-2024-37369 is a privilege escalation vulnerability.
Can CVE-2024-37369 lead to further access within the system?
Yes, CVE-2024-37369 allows low-privilege users to edit scripts, potentially gaining further unauthorized access.
- agent/remedy
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/softwarecombine
- agent/event
- collector/nvd-api
- source/NVD
- vendor/rockwell automation
- canonical/rockwell automation factorytalk view se
- vendor/rockwellautomation
- canonical/factorytalk view
- version/factorytalk view/12.0