Machine-generated analysis · WAYSCloud LLM
ControlFLASH versions up to 15.07 grant write permissions to the Everyone group on the installation directory, enabling arbitrary code execution.
Context
The advisory concerns Rockwell Automation ControlFLASH software. Versions ≤ 15.07 assign write permissions to the Everyone group on the installation directory, allowing an attacker to run commands at the logged-in user’s level. The issue is corrected in version 15.08, and a manual permission-removal workaround is described.
Operator considerations
Check: Identify ControlFLASH installations running version 15.07 or earlier.
Successful exploitation of this vulnerability could give an attacker the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission level.
Read the full advisory on CISA →