Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rockwell Automation FactoryTalk System Services Vulnerable to Sensitive Information Disclosure
Vulnerability Description
The underlying feedback mechanism of Rockwell Automation's FactoryTalk System Services that transfers the FactoryTalk Policy Manager rules to relevant devices on the network does not verify that the origin of the communication is from a legitimate local client device. This may allow a threat actor to craft a malicious website that, when visited, will send a malicious script that can connect to the local WebSocket endpoint and wait for events as if it was a valid client device. If successfully exploited, this would allow a threat actor to receive information including whether FactoryTalk Policy Manager is installed and potentially the entire security policy.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Vulnerability Type
源验证错误
Vulnerability Title
Rockwell Automation FactoryTalk Services Platform 访问控制错误漏洞
Vulnerability Description
Rockwell Automation FactoryTalk Services Platform是美国罗克韦尔（Rockwell Automation）公司的一套由多个产品组成的服务平台，它为应用程序提供常规服务，如诊断信息、健康监视和实时数据访问等。 Rockwell Automation FactoryTalk Services Platform存在安全漏洞，该漏洞源于不会验证通信的来源是否来自合法的本地客户端设备。
CVSS Information
N/A
Vulnerability Type
N/A