CVE-2018-10619: ics-cert rockwell automation rslinx classic and factorytalk linx gateway Unquoted Search Path or Element

Vulnerability summary

CVE-2018-10619 is a high (CVSS 7.8) Unquoted Search Path or Element vulnerability in ics-cert rockwell automation rslinx classic and factorytalk linx gateway. EPSS estimates a 2.72% chance of exploitation in the next 30 days, higher than 85.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-06-2018
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.90.00 and prior may allow an authorized, but non-privileged local user to execute arbitrary code and allow a threat actor to escalate user privileges on the affected workstation.

• CWE-428Unquoted Search Path or ElementThe product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.