CVE-2021-42539
📋 TL;DR
This vulnerability allows attackers to restore system backups without proper permission validation, potentially leading to account takeover and unauthorized settings changes. It affects systems using the vulnerable backup/restore functionality, particularly in industrial control environments.
💻 Affected Systems
- Rockwell Automation FactoryTalk AssetCentre
📦 What is this software?
Wireless 1410d Gateway Firmware by Emerson
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative account takeover, unauthorized configuration changes, and potential disruption of industrial processes.
Likely Case
Unauthorized settings modification leading to system misconfiguration, data integrity issues, and potential operational impact.
If Mitigated
Limited impact with proper access controls and network segmentation preventing unauthorized backup restore attempts.
🎯 Exploit Status
Exploitation requires some level of system access but doesn't need administrative privileges initially. The vulnerability is in the backup restore process permission validation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FactoryTalk AssetCentre v10.00.00.09 and later
Vendor Advisory: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1133605
Restart Required: Yes
Instructions:
1. Download FactoryTalk AssetCentre v10.00.00.09 or later from Rockwell Automation. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart the system. 5. Verify the update was successful.
🔧 Temporary Workarounds
Restrict Backup/Restore Access
windowsLimit user permissions for backup and restore operations to only authorized administrators.
Configure Windows permissions to restrict access to backup/restore directories and functions
Network Segmentation
allIsolate FactoryTalk AssetCentre systems from untrusted networks and implement strict firewall rules.
Configure firewall to allow only necessary ports and protocols for authorized systems
🧯 If You Can't Patch
- Implement strict access controls and principle of least privilege for all users
- Monitor backup/restore activities and implement alerting for unauthorized attempts
🔍 How to Verify
Check if Vulnerable:
Check FactoryTalk AssetCentre version. If version is below 10.00.00.09, the system is vulnerable.Check Version:
Check version in FactoryTalk AssetCentre application or Windows Programs and FeaturesVerify Fix Applied:
Verify installed version is 10.00.00.09 or later and test backup/restore functionality with non-admin accounts.📡 Detection & Monitoring
Log Indicators:
- Unauthorized backup restore attempts
- Changes to user permissions or system settings from non-admin accounts
- Failed authentication attempts followed by backup operations
Network Indicators:
- Unusual network traffic to backup storage locations
- Unexpected connections to FactoryTalk AssetCentre backup ports
SIEM Query:
source="FactoryTalk" AND (event_type="backup_restore" OR event_type="permission_change") AND user_role!="admin"