CVE-2023-2444

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-11 · updated 2026-06-17
Weakness: CWE-352

Description

A cross site request forgery vulnerability exists in Rockwell Automation's FactoryTalk Vantagepoint. This vulnerability can be exploited in two ways. If an attacker sends a malicious link to a computer that is on the same domain as the FactoryTalk Vantagepoint server and a user clicks the link, the attacker could impersonate the legitimate user and send requests to the affected product. Additionally, if an attacker sends an untrusted link to a computer that is not on the same domain as the server and a user opens the FactoryTalk Vantagepoint website, enters credentials for the FactoryTalk Vantagepoint server, and clicks on the malicious link a cross site request forgery attack would be successful as well.

Affected products

FactoryTalk VantagePoint: before 8.40 — fixed in 8.40

How to fix

Upgrade to a fixed version: FactoryTalk VantagePoint 8.40. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-2444 or the next vulnerability affects your stack