{"id":"CVE-2024-45824","state":"PUBLISHED","title":"FactoryTalk® View Site Edition Remote Code Execution Vulnerability via Lack of Input Validation","description":"CVE-2024-45824 IMPACT\n\n\n\nA remote\ncode vulnerability exists in the affected products. The vulnerability occurs\nwhen chained with Path Traversal, Command Injection, and XSS Vulnerabilities\nand allows for full unauthenticated remote code execution. The link in the\nmitigations section below contains patches to fix this issue.","publishedAt":"2024-09-12T14:05:22.202Z","updatedAt":"2024-09-12T15:07:31.980Z","severity":{"score":9.2,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"Rockwell"},"assigner":"Rockwell","products":["Rockwell Automation FactoryTalk View Site Edition"],"affected":[{"vendor":"Rockwell Automation","product":"FactoryTalk View Site Edition","defaultStatus":"unaffected","versions":[{"version":"12.0-14.0","status":"affected"}]}],"references":["https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1696.html"],"weaknesses":["CWE-77"],"ingestedAt":"2026-10-29T20:07:47.831Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/45xxx/CVE-2024-45824.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-45824","state":"PUBLISHED","datePublished":"2024-09-12T14:05:22.202Z","dateUpdated":"2024-09-12T15:07:31.980Z","assignerShortName":"Rockwell","assignerOrgId":"b73dd486-f505-4403-b634-40b078b177f0","dateReserved":"2024-09-09T19:33:02.444Z"},"containers":{"cna":{"title":"FactoryTalk® View Site Edition Remote Code Execution Vulnerability via Lack of Input Validation","descriptions":[{"lang":"en","value":"CVE-2024-45824 IMPACT\n\n\n\nA remote\ncode vulnerability exists in the affected products. The vulnerability occurs\nwhen chained with Path Traversal, Command Injection, and XSS Vulnerabilities\nand allows for full unauthenticated remote code execution. The link in the\nmitigations section below contains patches to fix this issue."}],"affected":[{"vendor":"Rockwell Automation","product":"FactoryTalk View Site Edition","defaultStatus":"unaffected","versions":[{"version":"12.0-14.0","status":"affected"}]}],"references":[{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1696.html"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":9.2,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Rockwell","orgId":"b73dd486-f505-4403-b634-40b078b177f0","dateUpdated":"2024-09-12T14:05:22.202Z"},"datePublic":"2024-09-12T13:00:00.000Z","impacts":[{"capecId":"CAPEC-248","descriptions":[{"lang":"en","value":"CAPEC-248 Command Injection"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Navigate to\nthe following <a target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1151301\">link and apply patches</a>, directions are on the\nlink page (<a target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1151301\">https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1151301</a>)<u></u></p>\n\n\n\n\n\n<br>"}],"value":"Navigate to\nthe following  link and apply patches https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1151301 , directions are on the\nlink page ( https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1151301 )"}],"source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"rockwellautomation","product":"factorytalk_view","defaultStatus":"unknown","versions":[{"version":"12.0","status":"affected","lessThanOrEqual":"14.0","versionType":"custom"}],"cpes":["cpe:2.3:a:rockwellautomation:factorytalk_view:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-12T15:00:29.395196Z","id":"CVE-2024-45824","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-12T15:07:31.980Z"}}]}}}