PT-2018-8291 · Rockwell Automation · Factorytalk Activation

Published 2018-05-11 · Updated 2019-10-09 · CVE-2017-6015

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk Activation versions prior to 4.01

Description The issue allows an attacker to potentially execute arbitrary code with elevated privileges on the system by exploiting ambiguous whitespace in file paths. This can be achieved by an authorized, but not privileged, local user.

Recommendations For versions prior to 4.01, upgrade to Version 4.01 or later to resolve the issue.

Fix

Special Elements Injection

Weakness Enumeration

CWE-428

CWE-74

Related Identifiers

CVE-2017-6015

Affected Products

Factorytalk Activation

References · 5

• https://osv.dev/vulnerability/CVE-2017-6015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6015 · Security Note
• https://rockwellautomation.custhelp.com/app/answers/detail/a_id/939382 · Vendor Advisory
• http://securityfocus.com/bid/96996 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-047-02 · Note