CVE-2024-4609: Rockwell Automation Datalog Function within in FactoryTalk® View SE contains SQL Injection Vulnerability
A vulnerability exists in the Rockwell Automation FactoryTalk® View SE Datalog function that could allow a threat actor to inject a malicious SQL statement if the SQL database has no authentication in place or if legitimate credentials were stolen. If exploited, the attack could result in information exposure, revealing sensitive information. Additionally, a threat actor could potentially modify and delete the data in a remote database. An attack would only affect the HMI design time, not runtime.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply security best practices for FactoryTalk View SE Datalog so the SQL database is configured with authentication in place (avoid scenarios where the SQL database has no authentication or where legitimate credentials could be stolen), and protect/secure any SQL credentials used by the Datalog function.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4609?
CVE-2024-4609 is considered critical due to the potential for SQL injection attacks that could compromise the database.
How do I fix CVE-2024-4609?
To mitigate CVE-2024-4609, implement authentication for the SQL database and regularly change credentials to reduce the risk of exploitation.
What are the potential consequences of exploiting CVE-2024-4609?
Exploitation of CVE-2024-4609 can lead to unauthorized access to sensitive data and manipulation of the SQL database.
Which versions of FactoryTalk View SE are affected by CVE-2024-4609?
CVE-2024-4609 affects all versions of Rockwell Automation FactoryTalk View SE up to version 11.0.
Who is impacted by CVE-2024-4609?
Organizations using Rockwell Automation FactoryTalk View SE without proper SQL database security measures are impacted by CVE-2024-4609.