CVE-2023-46290:An unauthenticated attacker could potentially obtain a local Windows OS user token via the FactoryTalk Services Platform web service and use that token to log in to FactoryTalk Services Platform, enabling token impersonation (CWE-287). The vulnerability affects versions before 2.80 and has a high impact (CVSS v3.1 base score 8.1).

splash
Back

Description Preview

Due to inadequate code logic in the FactoryTalk Services Platform web service, a previously unauthenticated threat actor could obtain a local Windows OS user token and then use that token to authenticate to FactoryTalk Services Platform. This exploit is possible only if the authorized user has not previously logged in to the web service. The issue involves improper authentication (CWE-287) and token impersonation (CAPEC-633), with network-level access, no privileges required, and no user interaction. The vulnerability can impact confidentiality, integrity, and availability, and is fixed in version 2.80 or later. Mitigation requires upgrading to a patched version and applying recommended security practices.

Overview

This vulnerability arises from insufficient authentication logic in the FactoryTalk Services Platform web service, enabling a threat actor to obtain a local Windows token and use it to access the platform. It requires no user interaction and can be exploited over the network. The flaw is categorized as CWE-287 Improper Authentication and CAPEC-633 Token Impersonation, with a high potential impact if exploited. Only versions prior to 2.80 are affected; upgrading to a fixed release mitigates the issue.

Remediation

  • Upgrade to FactoryTalk Services Platform version 2.80 or newer, as this version contains the remediation for the vulnerability. Verify compatibility with your environment using Rockwell’s compatibility tooling (the compatibility page linked in Rockwell’s notices) to determine the exact version that fits your deployment.
  • After upgrading, review and apply Rockwell’s security guidance (QA43240) for hardened configuration and best practices.
  • Verify that the web service requires proper authentication and that token issuance cannot be misused to log in as the user. Perform security testing to confirm the vulnerability is mitigated.
  • If feasible, restrict access to the FactoryTalk Services Platform web service to trusted networks or authenticated clients to reduce exposure.
  • Validate the environment post-upgrade with relevant security scans and maintain a process to apply future security updates promptly.

References

  • Rockwell Automation: FactoryTalk Services Platform Elevated Privileges Vulnerability. https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141165
  • Compatibility and upgrade guidance for FactoryTalk Services Version (Compatibility page referenced in remediation). https://compatibility.rockwellautomation.com/Pages/MultiProductCompareSelections.aspx?crumb=113&versions=61602,60883,59837,59480,58564,57413,58591,59481,59482,59483,59484,59485,59486,59487,59488,59490,59491,59492,59493,59494,59495,59496
  • QA43240 - Recommended Security Guidelines from Rockwell Automation. https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012
  • CWE-287: Improper Authentication. https://cwe.mitre.org/data/definitions/287.html
  • CAPEC-633: Token Impersonation. https://capec.mitre.org/data/definitions/633.html

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing: Low
    Manufacturing
  2. Retail Trade: Low
    Retail Trade
  3. Accommodation & Food Services: Low
    Accommodation & Food Services
  4. Administrative, Support, Waste Management & Remediation Services: Low
    Administrative, Support, Waste Management & Remediation Services
  5. Agriculture, Forestry Fishing & Hunting: Low
    Agriculture, Forestry Fishing & Hunting
  6. Arts, Entertainment & Recreation: Low
    Arts, Entertainment & Recreation
  7. Construction: Low
    Construction
  8. Educational Services: Low
    Educational Services
  9. Finance and Insurance: Low
    Finance and Insurance
  10. Health Care & Social Assistance: Low
    Health Care & Social Assistance
  11. Information: Low
    Information
  12. Management of Companies & Enterprises: Low
    Management of Companies & Enterprises
  13. Mining: Low
    Mining
  14. Other Services (except Public Administration): Low
    Other Services (except Public Administration)
  15. Professional, Scientific, & Technical Services: Low
    Professional, Scientific, & Technical Services
  16. Public Administration: Low
    Public Administration
  17. Real Estate Rental & Leasing: Low
    Real Estate Rental & Leasing
  18. Transportation & Warehousing: Low
    Transportation & Warehousing
  19. Utilities: Low
    Utilities
  20. Wholesale Trade: Low
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background