CVE-2017-6015

Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an attacker to link to or run a malicious executable. This may allow an authorized, but not privileged local user to execute arbitrary code with elevated privileges on the system. CVSS v3 base score: 8.8, CVSS vector string: (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Rockwell Automation has released a new version of FactoryTalk Activation, Version 4.01, which addresses the identified vulnerability. Rockwell Automation recommends upgrading to the latest version of FactoryTalk Activation, Version 4.01 or later.

Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an attacker to link to or run a malicious executable. This may allow an authorized, but not privileged local user to execute arbitrary code with elevated privileges on the system. CVSS v3 base score: 8.8, CVSS vector string: (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Rockwell Automation has released a new version of FactoryTalk Activation, Version 4.01, which addresses the identified vulnerability. Rockwell Automation recommends upgrading to the latest version of FactoryTalk Activation, Version 4.01 or later.

Sin comillas, cualquier espacio en blanco en la ruta de archivo de Rockwell Automation FactoryTalk Activation 4.00.02 se mantiene ambiguo. Esto puede permitir que un atacante vincule o ejecute un archivo malicioso. Esto puede permitir que un usuario local autorizado sin privilegios ejecute código arbitrario con privilegios elevados en el sistema. Puntuación base de CVSS v3: 8.8, cadena de vector CVSS: (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Rockwell Automation ha lanzado una nueva versión de FactoryTalk Activation, versión 4.01, que aborda esta vulnerabilidad identificada. Rockwell Automation recomienda actualizar a la última versión de FactoryTalk Activation, la 4.01 o posteriores.