{"id":"CVE-2025-24482","state":"PUBLISHED","title":"FactoryTalk® View Site Edition - Local Code Injection","description":"A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default permissions and allows for DLLs to be executed with higher level permissions.","publishedAt":"2025-01-28T20:59:50.868Z","updatedAt":"2025-01-28T21:34:16.702Z","severity":{"score":7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","source":"Rockwell"},"assigner":"Rockwell","products":["Rockwell Automation FactoryTalk® View Site Edition"],"affected":[{"vendor":"Rockwell Automation","product":"FactoryTalk® View Site Edition","defaultStatus":"unaffected","versions":[{"version":"<V15","status":"affected"}]}],"references":["https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1720.html"],"weaknesses":["CWE-94"],"ingestedAt":"2026-10-29T20:08:47.682Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/24xxx/CVE-2025-24482.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-24482","state":"PUBLISHED","datePublished":"2025-01-28T20:59:50.868Z","dateUpdated":"2025-01-28T21:34:16.702Z","assignerShortName":"Rockwell","assignerOrgId":"b73dd486-f505-4403-b634-40b078b177f0","dateReserved":"2025-01-21T21:21:03.342Z"},"containers":{"cna":{"title":"FactoryTalk® View Site Edition - Local Code Injection","descriptions":[{"lang":"en","value":"A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default permissions and allows for DLLs to be executed with higher level permissions."}],"affected":[{"vendor":"Rockwell Automation","product":"FactoryTalk® View Site Edition","defaultStatus":"unaffected","versions":[{"version":"<V15","status":"affected"}]}],"references":[{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1720.html"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":7,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Rockwell","orgId":"b73dd486-f505-4403-b634-40b078b177f0","dateUpdated":"2025-01-28T20:59:50.868Z"},"datePublic":"2025-01-28T14:00:00.000Z","impacts":[{"capecId":"CAPEC-180","descriptions":[{"lang":"en","value":"CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">Upgrade to V15 or apply patch. Answer ID 1152304</span>\n\n<br>"}],"value":"Upgrade to V15 or apply patch. Answer ID 1152304"}],"source":{"discovery":"INTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">Check the environment variables (PATH), and make sure FactoryTalk® View SE installation path (C:\\Program Files (x86)\\Common Files\\Rockwell) is before all others</span>\n\n<br>"}],"value":"Check the environment variables (PATH), and make sure FactoryTalk® View SE installation path (C:\\Program Files (x86)\\Common Files\\Rockwell) is before all others"}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-28T21:34:07.646858Z","id":"CVE-2025-24482","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-28T21:34:16.702Z"}}]}}}