What’s Vulnerable › Vulnerabilities

CVE-2023-2746: Rockwell Automation Enhanced HIM Vulnerable to Cross-Site Request Forgery Attack

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-07-11 · updated 2026-06-17
• Weakness: CWE-352

Description

The Rockwell Automation Enhanced HIM software contains an API that the application uses that is not protected sufficiently and uses incorrect Cross-Origin Resource Sharing (CORS) settings and, as a result, is vulnerable to a Cross Site Request Forgery (CSRF) attack. To exploit this vulnerability, a malicious user would have to convince a user to click on an untrusted link through a social engineering attack or successfully perform a Cross Site Scripting Attack (XSS). Exploitation of a CSRF could potentially lead to sensitive information disclosure and full remote access to the affected products.

Affected products

• Rockwell Automation Enhanced HIM: 1.001

References

• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139760
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139760

Get alerted when CVE-2023-2746 or the next vulnerability affects your stack