Log in Start free

Vulnerability · Published Oct 17, 2022 · Assigned by Rockwell

CVE-2022-3158

High 8.8

In plain English

A high-severity SQL injection in FactoryTalk VantagePoint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.0% (higher than 91% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)4.0%top 9.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an input validation vulnerability. The FactoryTalk VantagePoint SQL Server lacks input validation when users enter SQL statements to retrieve information from the back-end database. If successfully exploited, this could allow a user with basic user privileges to perform remote code execution on the server.

Affected products (as reported)

VendorProductVersions
n/a FactoryTalk VantagePoint 8.0, 8.10, 8.20, 8.30, 8.31

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References