CVE-2024-37368

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote system with FTView to send a packet to the customer’s server to view an HMI project. Due to the lack of proper authentication, this action is allowed without proper authentication verification.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287CWE-306

Affected software

VendorProductVersions
Rockwell AutomationFactoryTalk® View SEv11.0
rockwellautomationfactorytalk_view>= v11.0, < v14.0

References

Timeline

Published
Jun 14, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-373698.8A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassingCVE-2024-37379.8A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been rated as critical. Affected by this issue is the function findCountCVE-2024-373707.5In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, caCVE-2024-373719.1In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message CVE-2024-373723.6The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not alwCVE-2024-373737.2Improper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated attacker with admin rights to achCVE-2024-373767.2SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticCVE-2024-373777.5A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a dCVE-2024-37389.8A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. This affects the function handlePath of the file /aCVE-2024-373805.3A misconfiguration on UniFi U6+ Access Point could cause an incorrect VLAN traffic forwarding to APs meshed to UniFi U6+ Access Point. AffCVE-2024-373818.0An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network tCVE-2024-373827.2An issue discovered in import host feature in Ab Initio Metadata Hub and Authorization Gateway before 4.3.1.1 allows attackers to run arbitr