Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Food and Agriculture, Water and Wastewater Systems.A CVSS v3 base score of 9.8 has been calculated the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). 4.2.2 IMPROPER RESTRICTION OF OPERATIONS WITHIN THE BOUNDS OF A MEMORY BUFFER CWE-119Ī custom string copying function of the license server manager in FlexNet Publisher does not use proper bounds checking on incoming data, allowing a remote, unauthenticated user to send crafted messages with the intent of causing a buffer overflow.ĬVE-2015-8277 has been assigned to this vulnerability. A CVSS v3 base score of 2.7 has been calculated the CVSS vector string is ( AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N). FactoryTalk Historian Site Edition (SE)Ĥ.2 VULNERABILITY OVERVIEW 4.2.1 IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79Ī Cross-Site Scripting (“XSS”) vulnerability was found in certain versions of Wibu-Systems CodeMeter that may allow local attackers to inject arbitrary web script or HTML via a specific field in a configuration file, allowing an attacker to access sensitive information, or even rewrite the content of the HTML page.ĬVE-2017-13754 has been assigned to this vulnerability.Users who recognize products from the following list are using FactoryTalk Activation Manager: The following products require FactoryTalk Activation Manager to store and keep track of Rockwell Automation software products and activation files. Ships with FlexNet Publisher v11.11.1.1 and earlier.FactoryTalk Activation Manager v4.00 and earlier.Ships with Wibu-Systems CodeMeter v6.50b and earlier,.FactoryTalk Activation Manager v4.00 and v4.01.Rockwell Automation reports these vulnerabilities affect licensing management software in the following FactoryTalk Activation Manager products: Successful exploitation of these vulnerabilities could allow a remote attacker to access sensitive information, rewrite content, or cause a buffer overflow that could result in remote code execution. This updated advisory is a follow-up to the updated advisory titled ICSA-18-102-02 Rockwell Automation FactoryTalk Activation Manager (Update A) that was published May 24, 2018, on the NCCIC/ICS-CERT website. Vulnerabilities: Cross-site Scripting, Improper Restriction of Operations within the Bounds of a Memory Buffer.Equipment: Factory Talk Activation Manager.

ATTENTION: Exploitable remotely/low skill level to exploit.

Factorytalk activation manager service