CVE-2024-10944

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

A Remote Code Execution vulnerability exists in the affected product. The vulnerability requires a high level of permissions and exists due to improper input validation resulting in the possibility of a malicious Updated Agent being deployed.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Rockwell Automation	FactoryTalk Updater	<4.20.00
rockwellautomation	factorytalk_updater	>= 4.00.00, <= 4.20.00

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1710.html

Timeline

Published: Nov 12, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-109457.3A Local Privilege Escalation vulnerability exists in the affected product. The vulnerability requires a local, low privileged threat actor t CVE-2024-109467.2A vulnerability classified as critical has been found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automatio CVE-2024-109477.2A vulnerability classified as critical was found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Man CVE-2024-109486.5A vulnerability in the upload function of binary-husky/gpt_academic allows any user to read arbitrary files on the system, including sensiti CVE-2024-10955.3The Build & Control Block Patterns – Boost up Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access of data due to a mi CVE-2024-109508.8In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection. The r CVE-2024-109527.3The The Authors List plugin for WordPress is vulnerable to arbitrary shortcode execution via update_authors_list_ajax AJAX action in all ver CVE-2024-109534.3An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notific CVE-2024-109548.8In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provi CVE-2024-109556.5A Regular Expression Denial of Service (ReDoS) vulnerability exists in gaizhenbiao/chuanhuchatgpt, as of commit 20b2e02. The server uses the CVE-2024-109567.1GPT Academy version 3.83 in the binary-husky/gpt_academic repository is vulnerable to Cross-Site WebSocket Hijacking (CSWSH). This vulnerabi CVE-2024-109578.8The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24