CVE-2024-10945 HIGH

CVE-2024-10945: FactoryTalk® Updater Local Privilege Escalation

Vendor Rockwell Automation

Product FactoryTalk Updater

Weakness CWE-754

Published November 12, 2024

Last update November 13, 2024

View on NVD All CVEs

CVSS base score

7.0/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A Local Privilege Escalation vulnerability exists in the affected product. The vulnerability requires a local, low privileged threat actor to replace certain files during update and exists due to a failure to perform proper security checks before installation.

Key dates

02Disclosure timeline

November 12, 2024 CVE published

November 13, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-10945 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/754.html

Related vulnerabilities

04Related CVE

CVE-2020-3449 Cisco IOS XR Software Additional Paths Denial of Service Vulnerability CVE-2026-33786 Junos OS: SRX1600, SRX2300, SRX4300: When a specific show command is executed chassisd crashes CVE-2025-14840 HTTP Client Manager - Less critical - Information disclosure - SA-CONTRIB-2025-126 CVE-2024-45085 IBM WebSphere Application Server denial of service CVE-2023-36835 Junos OS: QFX10000 Series: All traffic will be dropped after a specific valid IP packet has been received which needs to be routed over a VXLAN tunnel