PT-2025-1322 · Rockwell Automation · Factorytalk View Se

Published 2025-01-28 · Updated 2025-02-10 · CVE-2025-24480

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk View ME (affected versions not specified)

Description A remote code execution issue exists due to lack of input sanitation, which could allow a remote attacker to run commands or code as a high privileged user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-01097

CVE-2025-24480

Affected Products

Factorytalk View Se

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-24480 · Security Note
• https://bdu.fstec.ru/vul/2025-01097 · Security Note
• https://rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1719.html · Note
• https://t.me/cvedetector/16615 · Telegram Post
• https://twitter.com/Komodosec/status/1889028105282764814 · Twitter Post
• https://twitter.com/Dinosn/status/1885618333166301434 · Twitter Post
• https://twitter.com/WhalersLtd/status/1886335963212763408 · Twitter Post
• https://twitter.com/fridaysecurity/status/1885614827671826791 · Twitter Post
• https://twitter.com/JosephLykowski/status/1886106648202051970 · Twitter Post
• https://t.me/pentestingnews/55974 · Telegram Post
• https://twitter.com/pravin_karthik/status/1885857002154578209 · Twitter Post
• https://twitter.com/CVEnew/status/1884321790828372167 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1885613079112917040 · Twitter Post
• https://twitter.com/CveFindCom/status/1884323575345127816 · Twitter Post