CVE-2024-21917: Rockwell Automation FactoryTalk® Service Platform Service Token Vulnerability
A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service token and directory. If exploited, a malicious user could potentially retrieve user information and modify settings without any authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rockwell Automation FactoryTalk® Service Platformto a version that resolves this vulnerability.Fixed in v6.40 or later - Configuration
Set DCOM authentication level to 6 (Mitigating Microsoft DCOM Hardening Patch (CVE-2021-26414) for affected Rockwell Automation products).
FactoryTalk® Administration Console (System Policies → Application Authorization) DCOM authentication level = 6 - Configuration
If it is not possible to update to v6.40 or later, enable verification of the publisher information (digital signature) of any executable attempting to use the FactoryTalk® Services APIs, to prevent token retrieval/use due to lack of digital signing between the FTSP service token and directory.
FactoryTalk® Administration Console (System Policies → Application Authorization) Enable verification of the publisher information (digital signature) for executables using the FactoryTalk® Services APIs = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21917?
CVE-2024-21917 is classified as a critical severity vulnerability due to the potential for unauthorized access via service token exploitation.
How do I fix CVE-2024-21917?
To mitigate CVE-2024-21917, users should apply the latest security patches provided by Rockwell Automation for FactoryTalk Services Platform.
What is the impact of CVE-2024-21917?
The impact of CVE-2024-21917 allows a malicious user to gain unauthorized authentication access across FTSP directories.
Who is affected by CVE-2024-21917?
CVE-2024-21917 affects users of Rockwell Automation FactoryTalk® Service Platform versions up to 6.31.00.
Is there a workaround for CVE-2024-21917?
Currently, disabling the affected services temporarily can act as a workaround until the official patches are applied.