CVE-2024-6326

Katalog CVE

CVSS 5.5 · Medium EPSS 0,18%

Kerentanan Improper Privilege Management pada rockwellautomation factorytalk policy manager, rockwellautomation factorytalk system services. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

An exposure of sensitive information vulnerability exists in the Rockwell Automation FactoryTalk® System Service. A malicious user could exploit this vulnerability by starting a back-up or restore process, which temporarily exposes private keys, passwords, pre-shared keys, and database folders when they are temporarily copied to an interim folder. This vulnerability is due to the lack of explicit permissions set on the backup folder. If private keys are obtained by a malicious user, they could impersonate resources on the secured network.

Rincian

Terbit di NVD

16 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management
CWE-276: Incorrect Default Permissions

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1678.html mitigasi · advisory vendor