PT-2024-5046 · Rockwell Automation · Rockwell Automation Factorytalk Remote Access

Published 2024-05-14 · Updated 2024-09-20 · CVE-2024-3640

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Rockwell Automation FactoryTalk Remote Access (affected versions not specified)

Description: The issue is related to an unquoted executable path in the Rockwell Automation FactoryTalk Remote Access, which could result in remote code execution if exploited. This occurs because the executable path is not properly quoted while running the installer package, allowing a threat actor to potentially enter a malicious executable and run it as a System user. Exploitation requires admin privileges. There have been reports of this issue being exploited in real-world attacks, including a case where a government organization in Taiwan was targeted using spear-phishing emails.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-428

Related Identifiers

BDU:2024-05573

CVE-2024-3640

Affected Products

Rockwell Automation Factorytalk Remote Access

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-3640 · Security Note
• https://bdu.fstec.ru/vul/2024-05573 · Security Note
• https://twitter.com/virusbtn/status/1837049317032398972 · Twitter Post
• https://twitter.com/CVEnew/status/1791130794838409583 · Twitter Post
• https://rockwellautomation.com/en-us.html · Note
• https://cisa.gov/news-events/ics-advisories/icsa-24-135-01 · Note
• https://rockwellautomation.com/en-us/support/advisory.SD1671.html · Note