ZDI-20-733: (Pwn2Own) Rockwell Automation FactoryTalk Linx CopyRenameProject Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Rockwell Automation Studio 5000. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the CopyRenameProject parameter provided to hmiisapi.dll. The issue results from the lack of proper validation of user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-20-733?
The ZDI-20-733 vulnerability is considered critical due to its potential for arbitrary code execution without authentication.
How do I fix ZDI-20-733?
To fix the ZDI-20-733 vulnerability, you should apply the latest security patches provided by Rockwell Automation for affected products.
What products are affected by ZDI-20-733?
ZDI-20-733 affects Rockwell Automation products, specifically Rockwell Automation Studio 5000 and FactoryTalk Linx.
Can ZDI-20-733 be exploited remotely?
Yes, the ZDI-20-733 vulnerability can be exploited remotely by attackers without needing authentication.
What type of attack is associated with ZDI-20-733?
ZDI-20-733 is associated with remote code execution attacks, allowing attackers to execute arbitrary code.