The Rockwell Automation Security Advisory for part number 1756-L81ESK is related to a security vulnerability in the FactoryTalk Remote Access (FTRA) software version 13.5.0.174, which affects the execution of executable paths during the installation process. This vulnerability, identified as CVE-2024-3640, could allow a threat actor with admin privileges to run a malicious executable as a System user, potentially leading to remote code execution. The CVSS score for this vulnerability is 7.7/10 in version 3.1 and 7.0/10 in version 4.0.
The vulnerability is caused by an unquoted executable path in the FTRA installer package, which could be exploited by entering a malicious executable during the installation process. This vulnerability is categorized under CWE-428: Unquoted Search Path or Element.
To mitigate this vulnerability, users are advised to apply security best practices and upgrade to version 13.6 of the FTRA software if possible. For those unable to upgrade, additional security measures can be taken to minimize the risk of exploitation.
Technical Specifications:
- The part number 1756-L81ESK is related to a security advisory for the FactoryTalk Remote Access (FTRA) software version 13.5.0.174.
- The vulnerability affects the execution of executable paths during the installation process.
- The CVSS score for this vulnerability is 7.7/10 in version 3.1 and 7.0/10 in version 4.0.
Alarm/Error Codes:
No specific alarm or error codes are mentioned in the security advisory.
User Manuals:
No user manuals are mentioned in the security advisory.
Troubleshooting:
No troubleshooting steps are provided in the security advisory.
Programming:
No programming information is provided in the security advisory.
Installation:
No installation instructions are mentioned in the security advisory.
In summary, the part number 1756-L81ESK is related to a security advisory for the FactoryTalk Remote Access (FTRA) software version 13.5.0.174, which addresses a vulnerability in the execution of executable paths during the installation process. The advisory provides information on the vulnerability, its impact, and mitigations, but does not cover technical specifications, user manuals, troubleshooting, programming, or installation details.
Go to product