PT-2022-24548 · Rockwell Automation · Factorytalk Vantagepoint

Published 2022-10-17 · Updated 2025-05-13 · CVE-2022-38743

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31

Description The issue is related to an improper access control vulnerability. A malicious user with read-only privileges could potentially execute SQL statements in the back-end database through the FactoryTalk VantagePoint SQL Server account. Successful exploitation could allow the attacker to execute arbitrary code and gain access to restricted data.

Recommendations For versions 8.0, 8.10, 8.20, 8.30, 8.31, consider restricting access to the SQL Server account to prevent malicious users from executing SQL statements in the back-end database until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2022-38743

Affected Products

Factorytalk Vantagepoint

References · 5

• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137043 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-38743 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38743 · Security Note
• https://t.me/cvenotify/121938 · Telegram Post
• https://t.me/cibsecurity/51635 · Telegram Post