Skip to content
Sign in
5.9 Medium

CVE-2023-2638 Rockwell Automation's FactoryTalk System Services does not verify that a backup configuration archive is password…

Description

Rockwell Automation's FactoryTalk System Services does not verify that a backup configuration archive is password protected.   Improper authorization in FTSSBackupRestore.exe may lead to the loading of malicious configuration archives.  This vulnerability may allow a local, authenticated non-admin user to craft a malicious backup archive, without password protection, that will be loaded by FactoryTalk System Services as a valid backup when a restore procedure takes places. User interaction is required for this vulnerability to be successfully exploited.

Affected products and versions

Product Affected versions Fixed in
FactoryTalk System Services 6.20 earliest → 6.20 No fix stated

Other CVEs of FactoryTalk System Services

The 3 CVEs of FactoryTalk System Services →
CVE-2023-2639 The underlying feedback mechanism of Rockwell Automation's FactoryTalk System Services that transfers the FactoryTalk… 4.1 Medium CVE-2023-2637 Rockwell Automation's FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator… 7.3 High
Track this CVE