Microsoft Uncovers Critical Flaws in Rockwell Automation PanelView Plus

Microsoft has unveiled two security flaws in Rockwell Automation PanelView Moreover that could be weaponized by distant, unauthenticated attackers to execute arbitrary code and set off a denial-of-support (DoS) condition.

“The [remote code execution] vulnerability in PanelView Additionally consists of two tailor made lessons that can be abused to upload and load a destructive DLL into the device,” security researcher Yuval Gordon stated.

“The DoS vulnerability can take advantage of the similar personalized class to deliver a crafted buffer that the unit is unable to handle effectively, hence leading to a DoS.”

The record of shortcomings is as follows –

• CVE-2023-2071 (CVSS score: 9.8) – An poor input validation vulnerability that allows unauthenticated attackers to achieve remote code executed by using crafted destructive packets.

• CVE-2023-29464 (CVSS score: 8.2) – An inappropriate input validation vulnerability that will allow an unauthenticated danger actor to read through facts from memory by way of crafted destructive packets and result in a DoS by sending a packet larger sized than the buffer dimensions

Prosperous exploitation of the twin flaws permits an adversary to execute code remotely or lead to info disclosure or a DoS ailment.

When CVE-2023-2071 impacts FactoryTalk Watch Device Edition (versions 13., 12., and prior), CVE-2023-29464 impacts FactoryTalk Linx (variations 6.30, 6.20, and prior).

It is worthy of noting that advisories for the flaws ended up launched by Rockwell Automation on September 12, 2023, and October 12, 2023, respectively. The U.S. Cybersecurity and Infrastructure Security Company (CISA) produced its possess alerts on September 21 and October 17.

The disclosure comes as mysterious menace actors are thought to be exploiting a not long ago disclosed critical security flaw in HTTP File Server (CVE-2024-23692, CVSS score: 9.8) to produce cryptocurrency miners and trojans this sort of as Xeno RAT, Gh0st RAT, and PlugX.

The vulnerability, explained as a situation of template injection, lets a remote, unauthenticated attacker to execute arbitrary instructions on the affected process by sending a specifically crafted HTTP ask for.

Uncovered this post attention-grabbing? Comply with us on Twitter  and LinkedIn to read a lot more distinctive written content we publish.

Some parts of this post are sourced from:
thehackernews.com