CVE-2021-38457
📋 TL;DR
CVE-2021-38457 allows attackers to establish sessions with vulnerable servers without providing any authentication credentials. This affects industrial control systems using Rockwell Automation FactoryTalk Linx software, potentially enabling unauthorized access to critical infrastructure.
💻 Affected Systems
- Rockwell Automation FactoryTalk Linx
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems allowing attackers to manipulate processes, cause physical damage, or disrupt critical infrastructure operations.
Likely Case
Unauthorized access to industrial control networks enabling data theft, reconnaissance, or disruption of manufacturing processes.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to vulnerable systems.
🎯 Exploit Status
No authentication required makes exploitation trivial for any network-accessible system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FactoryTalk Linx version 6.11
Vendor Advisory: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1658.html
Restart Required: Yes
Instructions:
1. Download FactoryTalk Linx version 6.11 from Rockwell Automation. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart affected systems.
🔧 Temporary Workarounds
Network Segmentation
allIsolate FactoryTalk Linx servers from untrusted networks using firewalls and VLANs.
Access Control Lists
allImplement strict network access controls to limit connections to FactoryTalk Linx servers.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems from all untrusted networks.
- Deploy intrusion detection systems to monitor for unauthorized access attempts to FactoryTalk Linx services.
🔍 How to Verify
Check if Vulnerable:
Check FactoryTalk Linx version in Control Panel > Programs and Features. Versions below 6.11 are vulnerable.Check Version:
wmic product where name='FactoryTalk Linx' get versionVerify Fix Applied:
Verify version is 6.11 or higher and test that authentication is required for server connections.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated connection attempts to FactoryTalk Linx ports
- Multiple failed authentication attempts if logging enabled
Network Indicators:
- Unencrypted traffic to FactoryTalk Linx ports (44818, 2222)
- Connections from unexpected IP addresses
SIEM Query:
source_port=44818 OR source_port=2222 AND NOT (user_authenticated=true)