{"id":"CVE-2025-24481","state":"PUBLISHED","title":"FactoryTalk® View Site Edition - Incorrect Permission Assignment","description":"An Incorrect Permission Assignment Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect permissions being assigned to the remote debugger port and can allow for unauthenticated access to the system configuration.","publishedAt":"2025-01-28T20:55:54.833Z","updatedAt":"2025-02-12T20:01:10.657Z","severity":{"score":7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","source":"Rockwell"},"assigner":"Rockwell","products":["Rockwell Automation FactoryTalk® View Site Edition"],"affected":[{"vendor":"Rockwell Automation","product":"FactoryTalk® View Site Edition","defaultStatus":"unaffected","versions":[{"version":"<V15","status":"affected"}]}],"references":["https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1720.html"],"weaknesses":["CWE-732"],"ingestedAt":"2026-10-29T20:08:47.682Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/24xxx/CVE-2025-24481.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-24481","state":"PUBLISHED","datePublished":"2025-01-28T20:55:54.833Z","dateUpdated":"2025-02-12T20:01:10.657Z","assignerShortName":"Rockwell","assignerOrgId":"b73dd486-f505-4403-b634-40b078b177f0","dateReserved":"2025-01-21T21:21:03.342Z"},"containers":{"cna":{"title":"FactoryTalk® View Site Edition - Incorrect Permission Assignment","descriptions":[{"lang":"en","value":"An Incorrect Permission Assignment Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect permissions being assigned to the remote debugger port and can allow for unauthenticated access to the system configuration."}],"affected":[{"vendor":"Rockwell Automation","product":"FactoryTalk® View Site Edition","defaultStatus":"unaffected","versions":[{"version":"<V15","status":"affected"}]}],"references":[{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1720.html"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":7,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-732","description":"CWE-732 Incorrect Permission Assignment for Critical Resource","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Rockwell","orgId":"b73dd486-f505-4403-b634-40b078b177f0","dateUpdated":"2025-01-28T20:55:54.833Z"},"datePublic":"2025-01-28T14:00:00.000Z","impacts":[{"capecId":"CAPEC-223","descriptions":[{"lang":"en","value":"CAPEC-223: Debugger Access"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">Upgrade to V15 or apply patch, answer ID 1152306.</span><br>"}],"value":"Upgrade to V15 or apply patch, answer ID 1152306."}],"source":{"discovery":"INTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Protect physical access to the workstation &amp; r<span style=\"background-color: var(--wht);\">estrict access to port 8091 at the network or workstation.</span></p>"}],"value":"Protect physical access to the workstation & restrict access to port 8091 at the network or workstation."}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-24481","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-01-28T21:09:13.727971Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-12T20:01:10.657Z"}}]}}}