Vulnerability · Published Jun 14, 2024 · Assigned by Rockwell

CVE-2024-37368Rockwell Automation FactoryTalk® View SE v11 Information Leakage Vulnerability via Authentication Restriction

High 8.2

In plain English

A high-severity improper authentication in FactoryTalk® View SE from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.5%top 57.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote system with FTView to send a packet to the customer’s server to view an HMI project. Due to the lack of proper authentication, this action is allowed without proper authentication verification.

Affected products (as reported)

Vendor	Product	Versions
Rockwell Automation	FactoryTalk® View SE	v11.0

Weakness: CWE-287 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1676.html