CVE-2024-3640

Description

An unquoted executable path exists in the Rockwell Automation FactoryTalk® Remote Access™ possibly resulting in remote code execution if exploited. While running the FTRA installer package, the executable path is not properly quoted, which could allow a threat actor to enter a malicious executable and run it as a System user. A threat actor needs admin privileges to exploit this vulnerability.

Reserved 2024-04-10 | Published 2024-05-16 | Updated 2024-08-01 | Assigner Rockwell

Problem types

CWE-428 Unquoted Search Path or Element

Product status

Default status
unaffected

v13.5.0.174
affected

References

www.rockwellautomation.com/...s/support/advisory.SD1671.html

cve.org (CVE-2024-3640)

nvd.nist.gov (CVE-2024-3640)

Download JSON