CVE-2020-14516
📋 TL;DR
CVE-2020-14516 is a critical authentication bypass vulnerability in Rockwell Automation FactoryTalk Services Platform where SHA-256 password hashing fails, potentially allowing attackers to authenticate without valid credentials. This affects industrial control systems using FactoryTalk Services Platform versions 6.10.00 and 6.11.00. Organizations using these versions in their operational technology environments are at risk.
💻 Affected Systems
- Rockwell Automation FactoryTalk Services Platform
📦 What is this software?
Factorytalk Services Platform by Rockwellautomation
Factorytalk Services Platform by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems leading to operational disruption, safety incidents, or manipulation of physical processes.
Likely Case
Unauthorized access to FactoryTalk applications and services, potentially enabling data theft, configuration changes, or lateral movement within OT networks.
If Mitigated
Limited impact if systems are air-gapped, have strict network segmentation, and use defense-in-depth security controls.
🎯 Exploit Status
While no public proof-of-concept exists, authentication bypass vulnerabilities in industrial systems are frequently targeted. Attackers would need network access to FactoryTalk services.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 6.12.00 or later
Vendor Advisory: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1127683
Restart Required: Yes
Instructions:
1. Download FactoryTalk Services Platform version 6.12.00 or later from Rockwell Automation support portal. 2. Backup current configuration and data. 3. Install the update following Rockwell's installation guide. 4. Restart affected systems and services. 5. Verify proper functionality of FactoryTalk applications.
🔧 Temporary Workarounds
Network Segmentation
allIsolate FactoryTalk Services Platform systems from untrusted networks using firewalls and network segmentation.
Access Control Lists
allImplement strict network access controls to limit connections to FactoryTalk services only from authorized systems.
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems from other networks
- Deploy intrusion detection systems to monitor for authentication bypass attempts
🔍 How to Verify
Check if Vulnerable:
Check FactoryTalk Services Platform version in Control Panel > Programs and Features. If version is 6.10.00 or 6.11.00, system is vulnerable.Check Version:
wmic product where "name like 'FactoryTalk%'" get versionVerify Fix Applied:
Verify installed version is 6.12.00 or later. Test authentication functionality with valid and invalid credentials.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful access
- Unusual authentication patterns
- Access from unexpected IP addresses
Network Indicators:
- Authentication requests to FactoryTalk services from unauthorized sources
- Unusual traffic patterns to FactoryTalk ports
SIEM Query:
source="FactoryTalk" AND (event_type="authentication" AND result="success") FROM suspicious_ip_addresses