CVE-2017-6015 - CVE House

Back to Database

Status published High CVE-2017-6015

Without quotation marks, any whitespace in the file path for...

7.8 CVSS

Vulnerability Description

Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an attacker to link to or run a malicious executable. This may allow an authorized, but not privileged local user to execute arbitrary code with elevated privileges on the system. CVSS v3 base score: 8.8, CVSS vector string: (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Rockwell Automation has released a new version of FactoryTalk Activation, Version 4.01, which addresses the identified vulnerability. Rockwell Automation recommends upgrading to the latest version of FactoryTalk Activation, Version 4.01 or later.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-6015

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Rockwell Automation

View All →

ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities

ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities

Rockwell Automation ArmorStart® LT - Multiple Denial-of-Service Vulnerabilities

Rockwell Automation ArmorStart® AOP Denial-of-Service Vulnerability

432ES-IG3 Series A Denial-of-Service Vulnerability

Affected Vendor

Rockwell Automation

View all reports →

Affected Software

FactoryTalk Activation

Vulnerable Versions:

FactoryTalk Activation Service, Version 4.00.02 and prior versions.

Timeline

Official Publish: May 11th, 2018

Last Modified: September 16th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1574 Hijack Execution Flow

Privilege Escalation

T1036 Masquerading

Defense Evasion

T1543 Create or Modify System Process

T1059 Command and Scripting Interpreter

T1569 System Services