漏洞标题
《罗克韦尔自动化在FactoryTalk®系统服务中未加保护的私钥》
漏洞描述信息
罗克韦尔自动化 FactoryTalk® 系统服务中存在敏感信息暴露漏洞。恶意用户可以通过启动备份或恢复流程来利用此漏洞，在临时复制到暂存文件夹时，临时暴露私钥、密码、预共享密钥和数据库文件夹。此漏洞源于备份文件夹上未明确设置权限。如果恶意用户获取私钥，他们可能冒充受保护网络上的资源。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
漏洞类别
缺省权限不正确
漏洞标题
Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services
漏洞描述信息
An exposure of sensitive information vulnerability exists in the Rockwell Automation FactoryTalk® System Service. A malicious user could exploit this vulnerability by starting a back-up or restore process, which temporarily exposes private keys, passwords, pre-shared keys, and database folders when they are temporarily copied to an interim folder. This vulnerability is due to the lack of explicit permissions set on the backup folder. If private keys are obtained by a malicious user, they could impersonate resources on the secured network.
CVSS信息
N/A
漏洞类别
特权管理不恰当
漏洞标题
Rockwell Automation FactoryTalk System Service 安全漏洞
漏洞描述信息
Rockwell Automation FactoryTalk System Service是美国罗克韦尔（Rockwell Automation）公司的一款应用程序。提供实施安全策略所需的策略授权、证书授权、身份服务和部署服务。 Rockwell Automation FactoryTalk System Service存在安全漏洞，该漏洞源于存在敏感信息泄露漏洞，导致攻击者可冒充安全网络上的资源。
CVSS信息
N/A
漏洞类别
其他