## 1. EXECUTIVE SUMMARY
* **âCVSS v3 7.3**
* **âATTENTION: **Exploitable remotely/low attack complexity
* **âVendor: **Rockwell Automation
* **âEquipment: **FactoryTalk Services Platform
* **âVulnerabilities:** Use of Hard-coded Cryptographic Key, Improper Authentication, Origin Validation Error
## 2. RISK EVALUATION
âSuccessful exploitation of these vulnerabilities could allow an attacker to disclose information, load malicious configuration files, or elevate privileges from a user to an administrator.
## 3. TECHNICAL DETAILS
### 3.1 AFFECTED PRODUCTS
âThe following Rockwell Automation products are affected:
* âFactoryTalk Policy Manager: v6.11.0
* âFactoryTalk System Services: v6.11.0
### 3.2 VULNERABILITY OVERVIEW
**3.2.1 â[USE OF HARD-CODED CRYPTOGRAPHIC KEY CWE-321]()**
âHard-coded cryptographic key vulnerabilities could lead to privilege escalation. FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies. This vulnerability could allow a local authenticated non-admin user to generate an invalid administrator cookie giving them administrative privileges to the FactoryTalk Policy Manger database. The threat actor could make malicious changes to the database to be deployed when a legitimate FactoryTalk Policy Manager user deploys a security policy model. User interaction is required to successfully exploit this vulnerability.
â[CVE-2023-2637]() has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H]()).
**3.2.2 â[IMPROPER AUTHENTICATION CWE-287]()**
âImproper authorization in FTSSBackupRestore.exe could lead to the loading of malicious configuration archives. FactoryTalk System Services does not verify that backup configuration archives are password protected. This vulnerability could allow a local authenticated non-admin user to craft a malicious backup archive without password protection to be loaded by FactoryTalk System Services as a valid backup when a restore procedure takes place. This vulnerability requires user interaction for successful exploitation.
â[CVE-2023-2638]() has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H]()).
**3.2.3 â[ORIGIN VALIDATION ERROR CWE-346]()**
âOrigin validation errors could lead to information disclosure. The underlying feedback mechanism of FactoryTalk System Services that transfers the FactoryTalk Policy Manager rules to relevant devices on the network does not verify that the origin of the communication is from a legitimate local client device. This could allow a threat actor to craft a malicious website that, when visited, would send a malicious script to connect to the local WebSocket endpoint and wait for events as if it was a valid client device. If successfully exploited, this could allow a threat actor to receive information, including whether FactoryTalk Policy Manager is installed or the entire security policy. User interaction is required for successful vulnerability exploitation.
â[CVE-2023-2639]() has been assigned to this vulnerability. A CVSS v3 base score of 4.1 has been calculated; the CVSS vector string is ([AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N]()).
### 3.3 BACKGROUND
* â**CRITICAL INFRASTRUCTURE SECTORS:** Chemical, Commercial Facilities, Critical Manufacturing, Energy, Government Facilities, Water and Wastewater Systems
* â**COUNTRIES/AREAS DEPLOYED:** Worldwide
* **âCOMPANY HEADQUARTERS LOCATION: **United States
### 3.4 RESEARCHER
âSharon Brizinov of Claroty Research – Team82 reported these vulnerabilities to CISA.
## 4. MITIGATIONS
âRockwell Automation encourages users to upgrade to the latest version:
* âUpgrade to [v6.30.00]() or later.
âCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
* âMinimize network exposure for all control system devices and/or systems, and ensure they are [not accessible from the Internet]().
* âLocate control system networks and remote devices behind firewalls and isolate them from business networks.
* âWhen remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.
âCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
âCISA also provides a section for [control systems security recommended practices]() on the ICS webpage at [cisa.gov/ics](). Several CISA products detailing cyber defense best practices are available for reading and download, including [Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies]().
âAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at [cisa.gov/ics]() in the technical information paper, [ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies]().
âOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
âNo known public exploits specifically target these vulnerabilities.Read More
References
Back to Main
