CVE-2023-2071 FactoryTalk View Machine Edition Vulnerable to Remote Code Execution

Critical 9.8 Published 12 Sep 2023 Updated 25 Sep 2024

Unauthenticated attackers can upload malicious libraries to bypass security checks and execute arbitrary code on FactoryTalk View Machine Edition devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-2071?

CVE-2023-2071 is a critical vulnerability in Rockwell Automation Fa, published on 12 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve remote code executed via crafted malicious packets. The device has the functionality, through a CIP class, to execute exported functions from libraries. There is a routine that restricts it to execute specific functions from two dynamic link library files. By using a CIP class, an attacker can upload a self-made library to the device which allows the attacker to bypass the security check and execute any code written in the function.

Weakness: CWE-434, CWE-20

Which versions are affected by CVE-2023-2071?

It affects 1 product.

Products include Rockwellautomation Factorytalk View.

How do I fix CVE-2023-2071?

No fix has been published for CVE-2023-2071 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-2071 being exploited?

There is no known exploitation of CVE-2023-2071 in the wild and no public exploit code.

Sources

Also known as GHSA-5cg3-92mh-qgvc.