by Kastro
Paper/Archive/CVE-2024-21915

CVE-2024-21915

Rockwell Automation FactoryTalk® Service Platform — Rockwell Automation FactoryTalk® Service Platform Elevated Privileges Vulnerability Through Web Service Functionality

EPSS 1.0%CVSS 9.0
critical.is priorityof 100
40
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 62.5.625 × 2012.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform (FTSP). If exploited, a malicious user with basic user group privileges could potentially sign into the software and receive FTSP Administrator Group privileges. A threat actor could potentially read and modify sensitive data, delete data and render the FTSP system unavailable.

Affected

ProductAffectedFixed inSource
FactoryTalk® Service Platform <v2.74–CNA
factorytalk_services_platform< 2.742.74CISA-ADP

Scores by source

Rockwell (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refrockwellautomation.com/en-us/support/advisory.SD1662.html