Microsoft has revealed two safety flaws in Rockwell Automation PanelView Plus that might be weaponized by distant, unauthenticated attackers to execute arbitrary code and set off a denial-of-service (DoS) situation.
“The [remote code execution] vulnerability in PanelView Plus entails two customized lessons that may be abused to add and cargo a malicious DLL into the gadget,” safety researcher Yuval Gordon mentioned.
“The DoS vulnerability takes benefit of the identical customized class to ship a crafted buffer that the gadget is unable to deal with correctly, thus resulting in a DoS.”
The record of shortcomings is as follows –
- CVE-2023-2071 (CVSS rating: 9.8) – An improper enter validation vulnerability that permits unauthenticated attackers to attain distant code executed by way of crafted malicious packets.
- CVE-2023-29464 (CVSS rating: 8.2) – An improper enter validation vulnerability that permits an unauthenticated risk actor to learn knowledge from reminiscence by way of crafted malicious packets and end in a DoS by sending a packet bigger than the buffer dimension
Profitable exploitation of the dual flaws permits an adversary to execute code remotely or result in info disclosure or a DoS situation.
Whereas CVE-2023-2071 impacts FactoryTalk View Machine Version (variations 13.0, 12.0, and prior), CVE-2023-29464 impacts FactoryTalk Linx (variations 6.30, 6.20, and prior).
It is price noting that advisories for the failings have been launched by Rockwell Automation on September 12, 2023, and October 12, 2023, respectively. The U.S. Cybersecurity and Infrastructure Safety Company (CISA) launched its personal alerts on September 21 and October 17.
The disclosure comes as unknown risk actors are believed to be exploiting a not too long ago disclosed essential safety flaw in HTTP File Server (CVE-2024-23692, CVSS rating: 9.8) to ship cryptocurrency miners and trojans akin to Xeno RAT, Gh0st RAT, and PlugX.
The vulnerability, described as a case of template injection, permits a distant, unauthenticated attacker to execute arbitrary instructions on the affected system by sending a specifically crafted HTTP request.
