Microsoft Identifies Critical Deficiencies in Rockwell Automation PanelView Plus

July 4, 2024NewsroomVulnerability / Critical Infrastructure

Two security vulnerabilities in Rockwell Automation PanelView Plus have been unveiled by Microsoft, which could be exploited by remote, unauthenticated attackers to perform arbitrary code execution and initiate a denial-of-service (DoS) occurrence.

Security researcher Yuval Gordon remarked, “According to Microsoft, the PanelView Plus [remote code execution] vulnerability involves the misuse of two custom classes that can be manipulated to upload and introduce a malevolent DLL into the device.”

“Exploiting the DoS vulnerability is based on the same unique class to transmit a micromanaged buffer that the device is incompetent to manage correctly, thereby leading to a Denial of Service.”

The identified shortcomings are outlined as follows:

• CVE-2023-2071 (CVSS score: 9.8) – A flaw in input validation that allows remote, unauthenticated attackers to accomplish remote code execution through carefully crafted malicious packets.

• CVE-2023-29464 (CVSS score: 8.2) – An input validation inadequacy enabling an unauthenticated malicious actor to retrieve data from memory using meticulously crafted malevolent packets and provoke a DoS scenario by dispatching a packet exceeding the buffer size.

Achieving successful exploitation of these dual vulnerabilities enables a perpetrator to execute code from a distance or prompt data disclosure or a DoS incident.

While CVE-2023-2071 affects versions 13.0, 12.0, and earlier of FactoryTalk View Machine Edition, CVE-2023-29464 impacts versions 6.30, 6.20, and prior of FactoryTalk Linx.

It’s important to note that security advisories for these vulnerabilities were published by Rockwell Automation on September 12, 2023 and October 12, 2023, respectively. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued alerts on September 21 and October 17.

The disclosure coincides with reports of malicious actors exploiting a recently uncovered critical security flaw in HTTP File Server (CVE-2024-23692, CVSS score: 9.8) to distribute cryptocurrency miners and trojans like Xeno RAT, Gh0st RAT, and PlugX.

The vulnerability, identified as a case of template injection, authorizes a remote, unauthenticated attacker to execute arbitrary commands on the impacted system by transmitting a meticulously crafted HTTP request.