^{CVE-2024-21914:}A vulnerability in Rockwell Automation FactoryTalk View ME running on PanelView Plus 7 boot terminals allows a malicious user to remotely restart the terminal without security protections, potentially resulting in loss of view or control of the PanelView product. The issue affects versions earlier than v14.

CVE-2024-21914 describes a security weakness in FactoryTalk View ME on PanelView Plus 7 boot terminals that permits remote restart by an unauthenticated or unprotected actor. Exploitation could lead to loss of view or control of the PanelView product. The vulnerability is classified under improper security protection for a remote restart action (CAPEC-554) and has a CVSS v3.1 base score of 5.3 (Medium) with network attack vector, no confidentiality or integrity impact, and low availability impact. No privileges are required, and no user interaction is needed. Affected products are Rockwell’s FactoryTalk View ME prior to version 14. Official remediation guidance is published by Rockwell Automation as advisory SD1663, with recommended security practices for environments where upgrading is not feasible.

Overview

This CVE covers a risk in FactoryTalk View ME on PanelView Plus 7 boot terminals where a remote restart can be initiated without proper security protections, potentially removing operators’ view or control over the PanelView device. The vulnerability affects versions older than v14 and carries a medium severity with network-based exploitation, requiring no user interaction or privileges. Mitigation centers on upgrading to a fixed release or applying vendor-recommended security practices to minimize exposure.

Remediation

• Upgrade to FactoryTalk View ME version 14 or later (the fixed release) to address the vulnerability.
• If upgrading is not possible, apply the vendor’s security best practices immediately:
  • Limit exposure by isolating the PanelView Plus 7 terminal behind network boundaries (firewalls, segmentation) and restrict remote restart capabilities where feasible.
  • Enforce strong access controls and authentication for management interfaces; disable anonymous remote restart features if available.
  • Restrict remote management to trusted networks and apply principle of least privilege.
  • Monitor and log restart attempts and review security advisories for additional defensive steps.
  • Review and implement Rockwell Security Best Practices as outlined in their guidance: Security Best Practices link.
• Verify the remediation with a follow-up assessment or scan to confirm the vulnerability is mitigated.

References for remediation guidance:

• Rockwell Automation Advisory SD1663: https://www.rockwellautomation.com/en-us/support/advisory.SD1663.html
• Security Best Practices: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

References

• Rockwell Automation Advisory SD1663: https://www.rockwellautomation.com/en-us/support/advisory.SD1663.html
• Security Best Practices: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight