CVE-2024-10943:
Authentication bypass vulnerability in Rockwell Automation's FactoryTalk Updater due to shared secrets across accounts, enabling impersonation; affects versions 4.00.00–4.10.00; patch available in version 4.20.00.
Score
A numerical rating that indicates how dangerous this vulnerability is.
9.1Critical- Published Date:Nov 12, 2024
- CISA KEV Date:*No Data*
- Industries Affected:20
Threat Predictions
- EPSS Score:0.1
- EPSS Percentile:31%
Exploitability
- Score:3.9
- Attack Vector:NETWORK
- Attack Complexity:LOW
- Privileges Required:NONE
- User Interaction:NONE
- Scope:UNCHANGED
Impact
- Score:5.2
- Confidentiality Impact:HIGH
- Integrity Impact:HIGH
- Availability Impact:NONE
Description Preview
Authentication bypass vulnerability in Rockwell Automation's FactoryTalk Updater due to shared secrets across accounts, enabling impersonation; affects versions 4.00.00–4.10.00; patch available in version 4.20.00.
Overview
Rockwell Automation’s FactoryTalk Updater contains an authentication bypass that stems from shared secrets across accounts, potentially allowing an attacker to impersonate a user if they can enumerate the necessary authentication information. The vulnerability is network-exploitable, requires no user interaction, and could lead to high-impact disclosure and integrity risks due to improper handling of sensitive credentials. It affects FactoryTalk Updater versions 4.00.00 through 4.10.00 and is classified as a critical issue, with a CVSS v3.1 base score of 9.1. The weakness aligns with CWE-922 for insecure storage of sensitive information. The recommended remediation is upgrading to a fixed version.
Remediation
- Upgrade FactoryTalk Updater to version 4.20.00 or later as specified by Rockwell’s advisory SD1710.
- After upgrading, verify the installed version to ensure the patch is applied (confirm 4.20.00 or newer).
- Review access controls and ensure the updater service is reachable only by authorized systems, and monitor for authentication-related anomalies.
- If possible, rotate or strengthen authentication secrets and ensure per-account secrets are not shared across multiple accounts going forward.
- Keep and apply security advisories from Rockwell and perform validation testing in a staging environment before deploying to production.
References
Industries Affected
Below is a list of industries most commonly impacted or potentially at risk based on intelligence.
