Rockwell Automation FactoryTalk® View SE Vulnerability Could Lead to Data Exposure and Modification

CVE-2024-4609

Summary

A vulnerability in Rockwell Automation's FactoryTalk® View SE Datalog function allows attackers to inject malicious SQL statements into the system. This can occur if the SQL database lacks authentication or if legitimate credentials are compromised. Exploiting this vulnerability may lead to the exposure of sensitive information and potentially allow attackers to modify or delete data in a remote database. It is important to note that the impact of the attack would only affect the HMI design environment, not the runtime operations.

References