Improper Input Validation (CWE-20)
A vulnerability exists in the Rockwell Automation FactoryTalk View SE Datalog function that could allow an attacker to inject a malicious SQL statement if the SQL database has no authentication in place or if legitimate credentials were stolen. This could lead to information exposure, revealing sensitive data, as well as potential modification or deletion of data in the remote database. However, the vulnerability only affects the HMI design time, not the runtime.
An attacker could exploit this vulnerability to gain unauthorized access to sensitive information stored in the database, as well as potentially modify or delete data. This could disrupt industrial operations, lead to system downtime, and potentially cause safety issues if critical data is tampered with. The attack would only affect the HMI design time, not runtime, which limits the immediate operational impact but still poses significant risks to data integrity and confidentiality.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. Rockwell Automation has released a security advisory (SD1679) on July 16, 2024, addressing this vulnerability in the FactoryTalk View SE Datalog function.
1. Apply the patch released by Rockwell Automation as soon as possible. 2. Ensure the SQL database is properly configured with strong authentication and access controls to prevent unauthorized access. 3. Implement the principle of least privilege and only grant the minimum necessary permissions to users and processes. 4. Monitor systems for any suspicious activity, especially during HMI design time operations. 5. Keep all software components up-to-date with the latest security patches. 6. If immediate patching is not possible, consider isolating or limiting network access to the affected systems. 7. Implement strong credential management practices to prevent credential theft. 8. Regularly audit and review database access logs for any signs of unauthorized access or suspicious queries.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Feedly found the first article mentioning CVE-2024-4609. See article
Feedly estimated the CVSS score as MEDIUM
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-4609
Feedly estimated the CVSS score as MEDIUM
Feedly estimated the CVSS score as HIGH
This CVE started to trend in security discussions
EPSS Score was set to: 0.04% (Percentile: 8.6%)
This CVE stopped trending in security discussions