CVE-2017-14022 Denial of service in Rockwell Automation FactoryTalk Alarms and Events
An unauthenticated remote attacker can cause the FactoryTalk Alarms and Events history archiver service to stall or terminate via crafted packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-14022?
CVE-2017-14022 is a high-severity denial of service vulnerability in Rockwell Automation FactoryTalk Alarms and Events, published on 23 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Improper Input Validation issue was discovered in Rockwell Automation FactoryTalk Alarms and Events, Version 2.90 and earlier. An unauthenticated attacker with remote access to a network with FactoryTalk Alarms and Events can send a specially crafted set of packets packet to Port 403/TCP (the history archiver service), causing the service to either stall or terminate.
Weakness: CWE-20
Which versions are affected by CVE-2017-14022?
It affects 1 product.
Products include Rockwellautomation Factorytalk Alarms and Events.
How do I fix CVE-2017-14022?
No fix has been published for CVE-2017-14022 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-14022 being exploited?
There is no known exploitation of CVE-2017-14022 in the wild and no public exploit code.
Other vulnerabilities in Rockwell Automation FactoryTalk Alarms and Events
Sources
Also known as GHSA-64w8-wm29-p94r.