Multiple vulnerabilities in Rockwell Automation FactoryTalk View SE



Published: 2020-06-19
Risk Medium
Patch available NO
Number of vulnerabilities 2
CVE-ID CVE-2020-12028
CVE-2020-12027
CWE-ID CWE-264
CWE-200
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #2 is available.
Vulnerable software
Subscribe
FactoryTalk View SE
Server applications / SCADA systems

Vendor Rockwell Automation

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU29159

Risk: Medium

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:F/RL:U/RC:C]

CVE-ID: CVE-2020-12028

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions within certain handlers. A remote authenticated attacker can utilize those handlers to interact with the data on the remote endpoint.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

FactoryTalk View SE: All versions


CPE2.3 External links

http://ics-cert.us-cert.gov/advisories/icsa-20-170-05

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.

2) Information disclosure

EUVDB-ID: #VU29160

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C]

CVE-ID: CVE-2020-12027

CWE-ID: CWE-200 - Information Exposure

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote authenticated attacker can gain unauthorized access to sensitive information on the system, such as the hostnames and file paths for certain files within the system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

FactoryTalk View SE: All versions


CPE2.3 External links

http://ics-cert.us-cert.gov/advisories/icsa-20-170-05

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.



###SIDEBAR###