| CVE-2017-6015 | Date: (C)2018-05-14 (M)2023-12-22 |
Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an attacker to link to or run a malicious executable. This may allow an authorized, but not privileged local user to execute arbitrary code with elevated privileges on the system. CVSS v3 base score: 8.8, CVSS vector string: (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Rockwell Automation has released a new version of FactoryTalk Activation, Version 4.01, which addresses the identified vulnerability. Rockwell Automation recommends upgrading to the latest version of FactoryTalk Activation, Version 4.01 or later.
CVSS Score and Metrics +CVSS Score and Metrics -| CVSS V3 Severity: | CVSS V2 Severity: |
| CVSS Score : 7.8 | CVSS Score : 7.2 |
| Exploit Score: 1.8 | Exploit Score: 3.9 |
| Impact Score: 5.9 | Impact Score: 10.0 |
| |
| CVSS V3 Metrics: | CVSS V2 Metrics: |
| Attack Vector: LOCAL | Access Vector: LOCAL |
| Attack Complexity: LOW | Access Complexity: LOW |
| Privileges Required: LOW | Authentication: NONE |
| User Interaction: NONE | Confidentiality: COMPLETE |
| Scope: UNCHANGED | Integrity: COMPLETE |
| Confidentiality: HIGH | Availability: COMPLETE |
| Integrity: HIGH | |
| Availability: HIGH | |
| | |
