How severe is CVE-2024-3640?

This vulnerability has a severity rating of HIGH with a CVSS score of N/A out of 10.

What type of vulnerability is CVE-2024-3640?

This is classified as CWE-428, which is a common weakness in software security.

CVE-2024-3640 - HIGH Severity | CVSS N/A

Vulnerability Description

An unquoted executable path exists in the Rockwell Automation FactoryTalk® Remote Access™ possibly resulting in remote code execution if exploited. While running the FTRA installer package, the executable path is not properly quoted, which could allow a threat actor to enter a malicious executable and run it as a System user. A threat actor needs admin privileges to exploit this vulnerability.

Related Vulnerabilities

CVE-2019-17658

CRITICAL

CVSS:9.8(Critical)

An unquoted service path vulnerability in the FortiClient FortiTray component of FortiClientWindows v6.2.2 and prior allow an attacker to gain elevated privileges via the FortiClientConsole executable...

CWE-4282019

CVE-2019-8459

CRITICAL

CVSS:9.8(Critical)

Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previously placed executable...

CWE-4282019

CVE-2020-14521

CRITICAL

CVSS:9.8(Critical)

Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, mo...

CWE-4282020

CVE-2020-9292

CRITICAL

CVSS:9.8(Critical)

An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable service path.

CWE-4282020

CVE-2022-36344

CRITICAL

CVSS:9.8(Critical)

An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affe...

CWE-4282022

CVE-2023-38408

CRITICAL

CVSS:9.8(Critical)

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Cod...

CWE-4282023