Sign-up

ID

VAR-202310-1699


CVE

CVE-2023-29464


TITLE

Rockwell Automation  Made  FactoryTalk Linx  Improper Input Validation Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-003918

DESCRIPTION

FactoryTalk Linx, in the Rockwell Automation PanelView Plus, allows an unauthenticated threat actor to read data from memory via crafted malicious packets. Sending a size larger than the buffer size results in leakage of data from memory resulting in an information disclosure. If the size is large enough, it causes communications over the common industrial protocol to become unresponsive to any type of packet, resulting in a denial-of-service to FactoryTalk Linx over the common industrial protocol. Rockwell Automation Provided by FactoryTalk Linx The following vulnerabilities exist in. It was * Inappropriate input confirmation (CWE-20) - CVE-2023-29464If the vulnerability is exploited, it may be affected as follows. It was * Information may be obtained by a remote third party via a specially crafted packet, or a denial of service (denial of service) may be attempted. DoS ) state. This product is mainly used for communication between small applications and large automation systems

Trust: 2.16

sources: NVD: CVE-2023-29464 // JVNDB: JVNDB-2023-003918 // CNVD: CNVD-2023-78312

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-78312

AFFECTED PRODUCTS

vendor:rockwellautomationmodel:factorytalk linxscope:eqversion:6.20

Trust: 1.0

vendor:rockwellautomationmodel:factorytalk linxscope:eqversion:6.30

Trust: 1.0

vendor:rockwell automationmodel:factorytalk linxscope:eqversion: -

Trust: 0.8

vendor:rockwell automationmodel:factorytalk linxscope:lteversion:v6.20 and earlier s

Trust: 0.8

vendor:rockwellmodel:automation factorytalk linxscope:lteversion:<=6.20

Trust: 0.6

sources: CNVD: CNVD-2023-78312 // JVNDB: JVNDB-2023-003918 // NVD: CVE-2023-29464

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-29464
value: CRITICAL

Trust: 1.0

PSIRT@rockwellautomation.com: CVE-2023-29464
value: HIGH

Trust: 1.0

NVD: CVE-2023-29464
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2023-78312
value: HIGH

Trust: 0.6

CNVD: CNVD-2023-78312
severity: HIGH
baseScore: 8.5
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 7.8
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2023-29464
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.2
version: 3.1

Trust: 1.0

PSIRT@rockwellautomation.com: CVE-2023-29464
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 4.2
version: 3.1

Trust: 1.0

NVD: CVE-2023-29464
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2023-78312 // JVNDB: JVNDB-2023-003918 // NVD: CVE-2023-29464 // NVD: CVE-2023-29464

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.0

problemtype:CWE-787

Trust: 1.0

problemtype:Inappropriate input confirmation (CWE-20) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-003918 // NVD: CVE-2023-29464

PATCH

title:Install the security patches for the respective versions (Login required) Rockwell Automationurl:https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140402/loc/en_US

Trust: 0.8

title:Patch for Rockwell Automation FactoryTalk Linx Input Validation Error Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/470471

Trust: 0.6

sources: CNVD: CNVD-2023-78312 // JVNDB: JVNDB-2023-003918

EXTERNAL IDS

db:NVDid:CVE-2023-29464

Trust: 3.2

db:JVNid:JVNVU93535614

Trust: 0.8

db:ICS CERTid:ICSA-23-290-02

Trust: 0.8

db:JVNDBid:JVNDB-2023-003918

Trust: 0.8

db:CNVDid:CNVD-2023-78312

Trust: 0.6

sources: CNVD: CNVD-2023-78312 // JVNDB: JVNDB-2023-003918 // NVD: CVE-2023-29464

REFERENCES

url:https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141040

Trust: 1.6

url:https://jvn.jp/vu/jvnvu93535614/index.html

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-29464

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-23-290-02

Trust: 0.8

sources: CNVD: CNVD-2023-78312 // JVNDB: JVNDB-2023-003918 // NVD: CVE-2023-29464

SOURCES

db:CNVDid:CNVD-2023-78312
db:JVNDBid:JVNDB-2023-003918
db:NVDid:CVE-2023-29464

LAST UPDATE DATE

2024-08-14T14:42:58.486000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2023-78312date:2023-10-20T00:00:00
db:JVNDBid:JVNDB-2023-003918date:2024-05-20T08:46:00
db:NVDid:CVE-2023-29464date:2023-10-20T20:10:53.483

SOURCES RELEASE DATE

db:CNVDid:CNVD-2023-78312date:2023-10-20T00:00:00
db:JVNDBid:JVNDB-2023-003918date:2023-10-19T00:00:00
db:NVDid:CVE-2023-29464date:2023-10-13T13:15:11.453