CWE Code: 74
Vulnerability Type: privilege_escalation
CVSS Score: 7.2
CWE Name:  Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Summary: without quotation marks, any whitespace in the file path for rockwell automation factorytalk activation version 4.00.02 remains ambiguous, which may allow an attacker to link to or run a malicious executable. this may allow an authorized, but not privileged local user to execute arbitrary code with elevated privileges on the system. cvss v3 base score: 8.8, cvss vector string: (av:l/ac:l/pr:l/ui:n/s:c/c:h/i:h/a:h). rockwell automation has released a new version of factorytalk activation, version 4.01, which addresses the identified vulnerability. rockwell automation recommends upgrading to the latest version of factorytalk activation, version 4.01 or later.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2018-05-11
Last Modified Date: 2019-10-09