CVE-2021-38477
📋 TL;DR
This vulnerability allows attackers to read, write, manipulate, or delete files through insecure API functions in affected industrial control systems. It affects multiple Rockwell Automation FactoryTalk products used in critical infrastructure environments.
💻 Affected Systems
- Rockwell Automation FactoryTalk Linx
- Rockwell Automation FactoryTalk Linx CommDTM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to delete critical files, manipulate industrial processes, or install persistent malware leading to physical damage or production shutdown.
Likely Case
Unauthorized file access leading to data theft, configuration manipulation, or denial of service through file deletion.
If Mitigated
Limited impact with proper network segmentation and access controls preventing exploitation attempts.
🎯 Exploit Status
The vulnerability requires no authentication and involves simple API calls, making exploitation straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FactoryTalk Linx version 6.12, FactoryTalk Linx CommDTM version 1.03
Vendor Advisory: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1653.html
Restart Required: Yes
Instructions:
1. Download the updated versions from Rockwell Automation's website. 2. Install FactoryTalk Linx version 6.12 or higher. 3. Install FactoryTalk Linx CommDTM version 1.03 or higher. 4. Restart affected systems.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected systems from untrusted networks using firewalls and VLANs.
Access Control Restrictions
allImplement strict access controls to limit which systems can communicate with vulnerable APIs.
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems from untrusted networks
- Deploy intrusion detection systems to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check installed versions of FactoryTalk Linx and FactoryTalk Linx CommDTM via Windows Programs and Features or using vendor-specific version checking tools.Check Version:
Check via Windows Control Panel > Programs and Features or use Rockwell Automation's FactoryTalk AssetCentre for inventory.Verify Fix Applied:
Verify that FactoryTalk Linx version is 6.12 or higher and FactoryTalk Linx CommDTM version is 1.03 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns via FactoryTalk APIs
- Multiple failed or successful file operations from unexpected sources
- Unauthorized API calls to file manipulation functions
Network Indicators:
- Unexpected network traffic to FactoryTalk services on port 44818 or other configured ports
- File operation requests from unauthorized IP addresses
SIEM Query:
source="FactoryTalk" AND (event_type="file_access" OR event_type="api_call") AND (src_ip NOT IN allowed_ips)