FKIE_CVE-2011-2957

Vulnerability from fkie_nvd - Published: 2011-07-28 18:55 - Updated: 2026-06-16 23:32
Severity
Summary
Unspecified vulnerability in Rockwell Automation FactoryTalk Diagnostics Viewer before V2.30.00 (CPR9 SR3) allows local users to execute arbitrary code via a crafted FactoryTalk Diagnostics Viewer (.ftd) configuration file, which triggers memory corruption.
References
cve@mitre.orghttp://rockwellautomation.custhelp.com/app/answers/detail/a_id/448424
cve@mitre.orghttp://www.securityfocus.com/bid/48962
cve@mitre.orghttp://www.us-cert.gov/control_systems/pdf/ICSA-11-175-01.pdfUS Government Resource
af854a3a-2127-422b-91ae-364da2661108http://rockwellautomation.custhelp.com/app/answers/detail/a_id/448424
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/48962
af854a3a-2127-422b-91ae-364da2661108http://www.us-cert.gov/control_systems/pdf/ICSA-11-175-01.pdfUS Government Resource
Impacted products
Vendor Product Version
rockwellautomation factorytalk_diagnostics_viewer *
rockwellautomation factorytalk_diagnostics_viewer 2.10
rockwellautomation factorytalk_diagnostics_viewer 2.10.01
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rockwellautomation:factorytalk_diagnostics_viewer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B46D0438-0887-4D15-A7A9-489D3B614207",
              "versionEndIncluding": "2.10.02",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rockwellautomation:factorytalk_diagnostics_viewer:2.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "76EA204F-17E4-4E78-B2DE-303036CD4887",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rockwellautomation:factorytalk_diagnostics_viewer:2.10.01:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A2BCE4F-E2CC-479F-B151-883F313D4379",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unspecified vulnerability in Rockwell Automation FactoryTalk Diagnostics Viewer before V2.30.00 (CPR9 SR3) allows local users to execute arbitrary code via a crafted FactoryTalk Diagnostics Viewer (.ftd) configuration file, which triggers memory corruption."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad no especificada en Rockwell Automation FactoryTalk Diagnostics Viewer antes de V2.30.00 (CPR9 SR3), permite a usuarios locales ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de un archivo de configuraci\u00f3n elaborado visor de FactoryTalk Diagnostics FactoryTalk Diagnostics Viewer (.ftd) manipulado que provoca corrupci\u00f3n de memoria."
    }
  ],
  "id": "CVE-2011-2957",
  "lastModified": "2026-06-16T23:32:19.700",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 6.9,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.4,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2011-07-28T18:55:03.737",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://rockwellautomation.custhelp.com/app/answers/detail/a_id/448424"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/48962"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-11-175-01.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rockwellautomation.custhelp.com/app/answers/detail/a_id/448424"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/48962"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-11-175-01.pdf"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.