CVE-2023-2071
criticalpriority · attend · 45EPSS 0.173 · 97 %ileEURUUSEPSS · scored 2026-10-27
Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve remote code executed via crafted malicious packets. The device has the functionality, through a CIP class, to execute exported functions from libraries. There is a routine that restricts it to execute specific functions from two dynamic link library files. By using a CIP class, an attacker can upload a self-made library to the device which allows the attacker to bypass the security check and execute any code written in the function.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedFactoryTalk View Machine Editioncisa_csaf_ot
Rockwell recommends updating FactoryTalk View Machine Edition with v12.0 & v13.0 patch
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139946/loc/en_US - MitigationFactoryTalk View Machine Editioncisa_csaf_ot
Users of the affected versions are encouraged by Rockwell Automation to upgrade to corrected firmware revisions. Uers are also strongly encouraged to implement Rockwell Automation's suggested security best practices to minimize the risk of the vulnerability.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (7)
Products and version ranges known to be affected.
- rockwellautomation factorytalk view≤ 13.0nvdUScpe:2.3:a:rockwellautomation:factorytalk_view:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-23-264-06Rockwell Automation FactoryTalk View Machine Edition2023-09-21icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to execute code remotely with specially crafted malicious packets or by using a self-made library to bypass security checks.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-2071/cnnvd
- https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140724cnnvd
- https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140724enisa_euvd
- https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140724Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan