CVE-2021-38469
📋 TL;DR
This vulnerability allows DLL hijacking through uncontrolled search paths in industrial control systems. Attackers can place malicious DLLs in directories searched by vulnerable services, leading to arbitrary code execution. Affects Rockwell Automation FactoryTalk Services Platform and related products.
💻 Affected Systems
- Rockwell Automation FactoryTalk Services Platform
- FactoryTalk Linx
- RSLinx Classic
- FactoryTalk View SE
- FactoryTalk View ME Station
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining SYSTEM privileges, enabling industrial sabotage, data theft, or ransomware deployment on critical infrastructure.
Likely Case
Local privilege escalation leading to persistent access, lateral movement within OT networks, and disruption of industrial processes.
If Mitigated
Limited impact with proper file permissions, application whitelisting, and network segmentation preventing DLL placement and execution.
🎯 Exploit Status
Requires local access or ability to place files on target system. DLL hijacking is well-understood attack vector with available tooling.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FactoryTalk Services Platform v6.11.01 and later
Vendor Advisory: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1652.html
Restart Required: Yes
Instructions:
1. Download FactoryTalk Services Platform v6.11.01 or later from Rockwell Automation website. 2. Stop all FactoryTalk services. 3. Install update following vendor instructions. 4. Restart system and verify services are running.
🔧 Temporary Workarounds
Restrict DLL search paths
windowsUse Windows policies to restrict DLL search order and prevent loading from current directory
Set registry key: HKLM\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode = 1
Set CWDIllegalInDllSearch registry key to appropriate value for your environment
File permission hardening
windowsRestrict write permissions to directories where FactoryTalk binaries are located
icacls "C:\Program Files\Rockwell Software\FactoryTalk Services\" /deny Users:(OI)(CI)W
icacls "C:\Program Files (x86)\Rockwell Software\FactoryTalk Services\" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Implement strict application whitelisting to prevent unauthorized DLL execution
- Segment OT networks from IT networks and restrict access to FactoryTalk systems
🔍 How to Verify
Check if Vulnerable:
Check FactoryTalk Services Platform version via Control Panel > Programs and Features. Versions 6.11.00 and earlier are vulnerable.Check Version:
wmic product where "name like 'FactoryTalk%'" get name, versionVerify Fix Applied:
Verify installed version is 6.11.01 or later. Check that DLL search path vulnerabilities are mitigated via Process Monitor or similar tools.📡 Detection & Monitoring
Log Indicators:
- Windows Event ID 4688 showing DLL loading from unexpected directories
- Sysmon Event ID 7 (Image loaded) showing DLLs loaded from non-standard paths
Network Indicators:
- Unusual outbound connections from FactoryTalk services
- Lateral movement attempts from FactoryTalk systems
SIEM Query:
source="windows" AND (event_id=4688 OR event_id=7) AND process_name="*FactoryTalk*" AND (file_path="*.\*" OR file_path="*\Temp\*")