CVE-2021-38461
📋 TL;DR
This vulnerability involves hard-coded Blowfish encryption keys in industrial control systems, allowing attackers to decrypt sensitive data and potentially manipulate system operations. It affects users of Rockwell Automation FactoryTalk Linx software versions 6.11 and earlier.
💻 Affected Systems
- Rockwell Automation FactoryTalk Linx
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing unauthorized control of industrial processes, data theft, and potential safety incidents in critical infrastructure.
Likely Case
Unauthorized access to sensitive configuration data, credential theft, and potential manipulation of industrial control communications.
If Mitigated
Limited impact if systems are air-gapped, have strict network segmentation, and use additional authentication layers.
🎯 Exploit Status
Exploitation requires extracting the hard-coded key from binaries and intercepting/decrypting communications.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FactoryTalk Linx version 6.12 or later
Vendor Advisory: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131435
Restart Required: Yes
Instructions:
1. Download FactoryTalk Linx version 6.12 or later from Rockwell Automation website. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart affected systems.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected systems from untrusted networks to prevent key extraction and communication interception.
Encryption Layer
allImplement additional encryption (TLS/SSL) for all communications involving FactoryTalk Linx.
🧯 If You Can't Patch
- Implement strict network access controls to limit communication to only trusted systems
- Monitor network traffic for unusual decryption attempts or unauthorized access patterns
🔍 How to Verify
Check if Vulnerable:
Check FactoryTalk Linx version via Control Panel > Programs and Features (Windows) or using vendor diagnostic tools.Check Version:
wmic product where name="FactoryTalk Linx" get versionVerify Fix Applied:
Verify installation of version 6.12 or later and confirm no hard-coded keys are present in updated binaries.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts, unusual network connections to FactoryTalk Linx services
Network Indicators:
- Unencrypted or suspiciously encrypted traffic to/from FactoryTalk Linx ports (typically 44818, 2222)
SIEM Query:
source="FactoryTalk" AND (event_type="authentication_failure" OR dest_port IN (44818, 2222))