Skip to content
OpenAdvisories
High ICSA-23-164-02 3 CVEs

Rockwell Automation FactoryTalk Services Platform

Published Jun 13, 2023 · Updated Jun 13, 2023

Vendor: Rockwell Automation Product: FactoryTalk Policy Manager Product: FactoryTalk System Services

Summary

Successful exploitation of these vulnerabilities could allow an attacker to disclose information, load malicious configuration files, or elevate privileges from a user to an administrator.

Vulnerabilities 3

  • High 7.3
    CVE-2023-2637

    Rockwell Automation FactoryTalk System Services Vulnerable To Use Of Hard-Coded Cryptographic Key

    Rockwell Automation's FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies.  Hard-coded cryptographic key may lead to privilege escalation.  This vulnerability may allow a local, authenticated non-admin user to gen…

    Rockwell Automation FactoryTalk System Services ICS / OT
  • Medium 5.9
    CVE-2023-2638

    Rockwell Automation FactoryTalk System Services Vulnerable to a Denial-of-Service Attack

    Rockwell Automation's FactoryTalk System Services does not verify that a backup configuration archive is password protected.   Improper authorization in FTSSBackupRestore.exe may lead to the loading of malicious configuration archives.  This vulnerability may…

    Rockwell Automation FactoryTalk System Services ICS / OT
  • Medium 4.1
    CVE-2023-2639

    Rockwell Automation FactoryTalk System Services Vulnerable to Sensitive Information Disclosure

    The underlying feedback mechanism of Rockwell Automation's FactoryTalk System Services that transfers the FactoryTalk Policy Manager rules to relevant devices on the network does not verify that the origin of the communication is from a legitimate local clien…

    Rockwell Automation FactoryTalk System Services ICS / OT

Revision history

  1. #1

    Initial Publication

References