CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-21918 – Rockwell Automation Arena Simulation Vulnerable To Memory Corruption
https://notcve.org/view.php?id=CVE-2024-21918
26 Mar 2024 — A memory buffer vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by corrupting the memory and triggering an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor. Una vulnerabilidad del búfer de memoria e... • https://www.rockwellautomation.com/en-us/support/advisory.SD-1665.html • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-21913 – Rockwell Automation Arena Simulation Vulnerable To Memory Corruption
https://notcve.org/view.php?id=CVE-2024-21913
26 Mar 2024 — A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code into the software by overstepping the memory boundaries, which triggers an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor. Una v... • https://www.rockwellautomation.com/en-us/support/advisory.SD-1665.html • CWE-122: Heap-based Buffer Overflow •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-21912 – Rockwell Automation Arena Simulation vulnerable to out of bounds write
https://notcve.org/view.php?id=CVE-2024-21912
26 Mar 2024 — An arbitrary code execution vulnerability in Rockwell Automation Arena Simulation could let a malicious user insert unauthorized code into the software. This is done by writing beyond the designated memory area, which causes an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor. • https://www.rockwellautomation.com/en-us/support/advisory.SD-1665.html • CWE-787: Out-of-bounds Write •
CVSS: 8.6EPSS: 0%CPEs: 6EXPL: 0CVE-2024-21916 – Rockwell Automation Denial-of-service Vulnerability in ICE1 Controller
https://notcve.org/view.php?id=CVE-2024-21916
31 Jan 2024 — A denial-of-service vulnerability exists in specific Rockwell Automation ControlLogix ang GuardLogix controllers. If exploited, the product could potentially experience a major nonrecoverable fault (MNRF). The device will restart itself to recover from the MNRF. Existe una vulnerabilidad de denegación de servicio en controladores Rockwell Automation ControlLogix ang GuardLogix. Si se explota, el producto podría experimentar un fallo importante no recuperable (MNRF). • https://www.rockwellautomation.com/en-us/support/advisory.SD1661.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-21917 – Rockwell Automation FactoryTalk® Service Platform Service Token Vulnerability
https://notcve.org/view.php?id=CVE-2024-21917
31 Jan 2024 — A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service token and directory. If exploited, a malicious user could potentially retrieve user information and modify settings without any authentication. Existe una vulnerabilidad en Rockwell Automation FactoryTalk® Service Platform que permite a un usuario malint... • https://www.rockwellautomation.com/en-us/support/advisory.SD1660.html • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2023-5909 – Improper Validation of Certificate with Host Mismatch in PTC KEPServerEx
https://notcve.org/view.php?id=CVE-2023-5909
30 Nov 2023 — KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect. KEPServerEX no valida adecuadamente los certificados de los clientes, lo que puede permitir que se conecten usuarios no autenticados. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-03 • CWE-295: Improper Certificate Validation CWE-297: Improper Validation of Certificate with Host Mismatch •
CVSS: 9.4EPSS: 0%CPEs: 8EXPL: 0CVE-2023-5908 – Heap Based Buffer Overflow in PTC KEPServerEx
https://notcve.org/view.php?id=CVE-2023-5908
30 Nov 2023 — KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information. KEPServerEX es vulnerable a un desbordamiento del búfer que puede permitir que un atacante bloquee el producto al que se accede o filtre información. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-03 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-122: Heap-based Buffer Overflow •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-27858 – Rockwell Automation Arena® Simulation Uninitialized Pointer Vulnerability
https://notcve.org/view.php?id=CVE-2023-27858
27 Oct 2023 — Rockwell Automation Arena Simulation contains an arbitrary code execution vulnerability that could potentially allow a malicious user to commit unauthorized code to the software by using an uninitialized pointer in the application. The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product. The user would need to open a malicious file provided to them by the attacker for the code to execute. Rockwell Automation Arena Simulation ... • https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141145 • CWE-824: Access of Uninitialized Pointer •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-27854 – Rockwell Automation Arena® Simulation Out of Bounds Read Vulnerability
https://notcve.org/view.php?id=CVE-2023-27854
27 Oct 2023 — An arbitrary code execution vulnerability was reported to Rockwell Automation in Arena Simulation that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow. The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product. The user would need to open a malicious file provided to them by the attacker for the code to execute. Se informó a Rockwell Automation en ... • https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141145 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 4%CPEs: 1EXPL: 0CVE-2023-46289 – Rockwell Automation FactoryTalk® View Site Edition Vulnerable to Improper Input Validation
https://notcve.org/view.php?id=CVE-2023-46289
27 Oct 2023 — Rockwell Automation FactoryTalk View Site Edition insufficiently validates user input, which could potentially allow threat actors to send malicious data bringing the product offline. If exploited, the product would become unavailable and require a restart to recover resulting in a denial-of-service condition. Rockwell Automation FactoryTalk View Site Edition no valida suficientemente la entrada del usuario, lo que podría permitir que los actores de amenazas envíen datos maliciosos y desconecten el producto... • https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141167 • CWE-20: Improper Input Validation •