Code Injection in FactoryTalk View SE - CVE-2025-24482
Published: January 29, 2025
Vulnerability identifier: #VU103428
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-24482
CWE-ID: CWE-94
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Rockwell Automation
Affected software:
FactoryTalk View SE
FactoryTalk View SE
Detailed vulnerability description
The vulnerability allows a local attacker to execute arbitrary code on the target system.
The vulnerability exists due to incorrect default permissions. A local attacker can use specially crafted DLLs and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
How to mitigate CVE-2025-24482
Install updates from vendor's website.