CVE-2024-6326: Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services
First published: Tue Jul 16 2024(Updated: )
An exposure of sensitive information vulnerability exists in the Rockwell Automation FactoryTalk® System Service. A malicious user could exploit this vulnerability by starting a back-up or restore process, which temporarily exposes private keys, passwords, pre-shared keys, and database folders when they are temporarily copied to an interim folder. This vulnerability is due to the lack of explicit permissions set on the backup folder. If private keys are obtained by a malicious user, they could impersonate resources on the secured network.
Credit: PSIRT@rockwellautomation.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rockwell Automation FactoryTalk Policy Manager | =6.40.0 | |
| Rockwell Automation FactoryTalk System Services | =6.40.0 |
Remedy
Users using the affected software are encouraged to implement the following steps to invalidate the existing vulnerable private keys/digital certificates and regenerate new secure ones. Security Best Practices https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-6326?
CVE-2024-6326 is considered a high severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2024-6326?
To fix CVE-2024-6326, upgrade the affected software to a patched version provided by Rockwell Automation.
What types of sensitive information are exposed by CVE-2024-6326?
CVE-2024-6326 can expose private keys, passwords, pre-shared keys, and database information.
Which versions of Rockwell Automation software are affected by CVE-2024-6326?
CVE-2024-6326 affects FactoryTalk® System Services and FactoryTalk® Policy Manager version 6.40.0.
Who can exploit CVE-2024-6326?
A malicious user with access to initiate a back-up or restore process can exploit CVE-2024-6326.
- agent/title
- agent/remedy
- agent/first-publish-date
- agent/type
- agent/description
- agent/references
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/rockwellautomation
- canonical/rockwell automation factorytalk policy manager
- version/rockwell automation factorytalk policy manager/6.40.0
- canonical/rockwell automation factorytalk system services
- version/rockwell automation factorytalk system services/6.40.0