What is CVE-2022-38743?

CVE-2022-38743 is a high-severity vulnerability in Rockwellautomation Factorytalk Vantagepoint, classified under Improper Access Control. CVSS score: 8.8/10. Published 2022-10-17.

How severe is CVE-2022-38743?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Rockwellautomation Factorytalk Vantagepoint

CVE-2022-38743

Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability. The FactoryTalk VantagePoint SQL Server account could allow a malicious user with read-only privileges to execute SQL statements in the back-end database. If successfully exploited, this could allow the attacker to execute arbitrary code and gain access to restricted data.

EPSS: 0.013 (68.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Rockwellautomation Factorytalk_vantagepoint — versions 8.0, 8.10, 8.20
N/a Factorytalk Vantagepoint — versions 8.0, 8.10, 8.20, 8.30, 8.31

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

PSIRT@rockwellautomation.com (Permissions Required, Vendor Advisory)

Frequently asked questions

What is CVE-2022-38743?: CVE-2022-38743 is a high-severity vulnerability in Rockwellautomation Factorytalk Vantagepoint, classified under Improper Access Control. CVSS score: 8.8/10. Published 2022-10-17.
How severe is CVE-2022-38743?: High severity. CVSS v3 base score is 8.8 out of 10.