CVE-2024-45824: FactoryTalk® View Site Edition Remote Code Execution Vulnerability via Lack of Input Validation
First published: Thu Sep 12 2024(Updated: )
CVE-2024-45824 IMPACT A remote code vulnerability exists in the affected products. The vulnerability occurs when chained with Path Traversal, Command Injection, and XSS Vulnerabilities and allows for full unauthenticated remote code execution. The link in the mitigations section below contains patches to fix this issue.
Credit: PSIRT@rockwellautomation.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FactoryTalk View | >=12.0<=14.0 | |
| FactoryTalk View |
Remedy
Navigate to the following link and apply patches https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1151301 , directions are on the link page ( https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1151301 )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-45824?
CVE-2024-45824 is classified as a critical severity vulnerability allowing unauthenticated remote code execution.
How do I fix CVE-2024-45824?
To mitigate CVE-2024-45824, it is recommended to apply the latest security patches provided by Rockwell Automation.
What products are affected by CVE-2024-45824?
CVE-2024-45824 affects Rockwell Automation's FactoryTalk View Site Edition versions 12.0 to 14.0.
Can CVE-2024-45824 be exploited remotely?
Yes, CVE-2024-45824 allows for full unauthenticated remote code execution when exploited.
What types of vulnerabilities are chainable with CVE-2024-45824?
CVE-2024-45824 can be chained with Path Traversal, Command Injection, and XSS vulnerabilities.
- agent/remedy
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/last-modified-date
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup-request
- vendor/rockwellautomation
- canonical/factorytalk view
- version/factorytalk view/12.0
- version/factorytalk view/14.0
- vendor/rockwell automation