Critical severity9.6NVD Advisory· Published Jul 11, 2023· Updated Jun 17, 2026
CVE-2023-2746
CVE-2023-2746
Description
The Rockwell Automation Enhanced HIM software contains
an API that the application uses that is not protected sufficiently and uses incorrect Cross-Origin Resource Sharing (CORS) settings and, as a result, is vulnerable to a Cross Site Request Forgery (CSRF) attack. To exploit this vulnerability, a malicious user would have to convince a user to click on an untrusted link through a social engineering attack or successfully perform a Cross Site Scripting Attack (XSS). Exploitation of a CSRF could potentially lead to sensitive information disclosure and full remote access to the affected products.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3v1.001+ 2 more
- (no CPE)range: v1.001
- (no CPE)
- cpe:2.3:a:rockwellautomation:enhanced_him:1.001:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
1- rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139760nvdPermissions RequiredVendor Advisory
News mentions
0No linked articles in our index yet.