Vulnerabilidades em Rockwell Automation

310 resultados
Análise Vexday

O portfólio de vulnerabilidades da Rockwell Automation soma 274 CVEs catalogadas, das quais nenhuma consta no catálogo CISA KEV de explorações ativas — índice abaixo da média geral do catálogo, o que indica menor pressão de exploração confirmada no momento. Ainda assim, a presença de 41 falhas de severidade crítica e o EPSS de 0,7809 associado a CVE-2023-2915 — o valor mais alto observado no conjunto — sinalizam risco probabilístico elevado para essa vulnerabilidade específica, merecendo atenção prioritária nas rotinas de patch. O tipo de falha mais recorrente é CWE-20 (validação imprópria de entrada), padrão que tende a se manifestar de formas variadas em ambientes de tecnologia operacional e requer controles de segmentação e validação em profundidade. Com 7 CVEs surgidas nos últimos 90 dias e ao menos 1 com prova de conceito pública disponível, a superfície de risco permanece ativa e demanda monitoramento contínuo.

CVE-2021-27470CRITICALRockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted DataEPSS 3.8%CVE-2021-27462CRITICALRockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted DataEPSS 3.8%CVE-2013-2805—Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPREPSS 3.8%CVE-2013-2807—Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPREPSS 3.8%CVE-2013-2806—Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPREPSS 3.8%CVE-2023-3596HIGHRockwell Automation Allen-Bradley ControlLogix Communication Modules vulnerable to Denial of Service EPSS 3.7%CVE-2018-14827—Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. A remote, unauthenticated threat actor may intentionally send specially craftEPSS 3.7%CVE-2021-27468CRITICALRockwell Automation FactoryTalk AssetCentre SQL InjectionEPSS 3.5%CVE-2021-27464CRITICALRockwell Automation FactoryTalk AssetCentre SQL InjectionEPSS 3.5%CVE-2022-1159HIGHRockwell Automation Studio 5000 Logix Designer Code InjectionEPSS 3.5%CVE-2021-27460CRITICALRockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted DataEPSS 3.2%CVE-2019-10955MEDIUMIn Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and earlier, MicroLogix 1100 Controllers v14.00 EPSS 3.0%CVE-2021-27475HIGHRockwell Automation Connected Components Workbench Deserialization of Untrusted DataEPSS 3.0%CVE-2023-0754CRITICAL The affected products are vulnerable to an integer overflow or wraparound, which could  allow an attacker to crash the server and remotely EPSS 2.9%CVE-2021-27471HIGHRockwell Automation Connected Components Workbench Path TraversalEPSS 2.9%CVE-2024-2425HIGHRockwell Automation - Denial-of-service and Input Validation Vulnerabilities in PowerFlex® 527EPSS 2.8%CVE-2024-2426HIGHRockwell Automation - Denial-of-service and Input Validation Vulnerabilities in PowerFlex® 527EPSS 2.8%CVE-2023-46290HIGHRockwell Automation FactoryTalk Services Platform Elevated Privileges VulnerabilityEPSS 2.7%CVE-2024-5988CRITICALRockwell Automation ThinManager® ThinServer™ Improper Input Validation VulnerabilityEPSS 2.7%CVE-2022-2463MEDIUMISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22EPSS 2.6%