CVE-2023-29026: rockwell automation armorstart st Improper Input Validation

Vulnerability summary

CVE-2023-29026 is a medium (CVSS 5.9) Improper Input Validation vulnerability in rockwell automation armorstart st. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.9% of scored vulnerabilities.

Timeline

1. 11-05-2023
   PublishedVulnerability first disclosed.
2. 24-01-2025
   Last modifiedVulnerability information updated.

Description

A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.