CVE-2022-3158 SQL injection in FactoryTalk VantagePoint

High 8.8 Published 17 Oct 2022 Updated 14 May 2025

Attackers with basic privileges can execute arbitrary code on the server via SQL injection in FactoryTalk VantagePoint.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-3158?

CVE-2022-3158 is a high-severity SQL injection vulnerability in FactoryTalk VantagePoint, published on 17 Oct 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an input validation vulnerability. The FactoryTalk VantagePoint SQL Server lacks input validation when users enter SQL statements to retrieve information from the back-end database. If successfully exploited, this could allow a user with basic user privileges to perform remote code execution on the server.

Weakness: CWE-89

Which versions are affected by CVE-2022-3158?

It affects 1 product.

Products include Rockwellautomation Factorytalk Vantagepoint.

How do I fix CVE-2022-3158?

No fix has been published for CVE-2022-3158 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-3158 being exploited?

There is no known exploitation of CVE-2022-3158 in the wild and no public exploit code.

Sources

Also known as GHSA-x5mm-8w3w-rp76.