Rockwell Automation FactoryTalk Historian ThingWorx
Advisory ansehen veröffentlicht 2025-05-22
Successful exploitation of this vulnerability could allow an attacker to launch XXE-based attacks on applications that accept malicious log4net configuration files.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-1285US | critical9.8 | Exploit | ||
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept a… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- ICS Advisory ICSA-25-142-02 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-25-142-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
Behebungen (2)
- Mitigation95057C-FTHTWXCT11
Rockwell Automation released a product update addressing this vulnerability:
- Behoben95057C-FTHTWXCT11
95057C-FTHTWXCT11: Versions v5.00.00 and later
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan