CVE-2024-45824

The vulnerability arises from the chaining of three separate weaknesses: path traversal, command injection and XSS. An attacker can remotely trigger this chain of vulnerabilities, which in effect leads to full, unauthenticated execution of arbitrary code on the vulnerable system. No user interaction is required to carry out the attack.

Attacker gains full control over the vulnerable system — can execute arbitrary code remotely without authentication, threatening confidentiality, integrity and availability of data and system.

Apply patches available from the manufacturer according to references — detailed information about fixes is available at: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1696.html

Rockwell Automation FactoryTalk View — versions indicated in the manufacturer's references (advisory SD1696)