{"cve":"CVE-2023-2071","nvd":{"published":"2023-09-12T14:15:09.663","modified":"2026-06-17T05:51:20.140","status":"Modified","description":"Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve remote code executed via crafted malicious packets.  The device has the functionality, through a CIP class, to execute exported functions from libraries.  There is a routine that restricts it to execute specific functions from two dynamic link library files.  By using a CIP class, an attacker can upload a self-made library to the device which allows the attacker to bypass the security check and execute any code written in the function.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-434","CWE-20"],"references":["https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140724","https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140724"],"products":["rockwellautomation:factorytalk_view"],"source":"nvd","synced_at":"2026-10-19T21:39:24.235896374+00:00"},"epss":{"cve":"CVE-2023-2071","score":0.17274,"percentile":0.97105,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}