CVE-2024-10386
📋 TL;DR
CVE-2024-10386 is a critical authentication vulnerability in Rockwell Automation products that allows unauthenticated attackers with network access to send crafted messages to manipulate databases. This affects industrial control systems and could lead to operational disruption. Organizations using affected Rockwell Automation devices are at risk.
💻 Affected Systems
- Rockwell Automation FactoryTalk View SE
- Rockwell Automation FactoryTalk Linx
📦 What is this software?
Thinmanager by Rockwellautomation
Thinmanager by Rockwellautomation
Thinmanager by Rockwellautomation
Thinmanager by Rockwellautomation
Thinmanager by Rockwellautomation
Thinmanager by Rockwellautomation
Thinmanager by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems leading to physical damage, production shutdown, or safety incidents through database manipulation.
Likely Case
Unauthorized access to control systems allowing data manipulation, configuration changes, or disruption of industrial processes.
If Mitigated
Limited impact if network segmentation, authentication controls, and monitoring prevent exploitation attempts.
🎯 Exploit Status
The vulnerability requires network access but no authentication, making exploitation straightforward for attackers with access to the network.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FactoryTalk View SE 12.00.02, FactoryTalk Linx 6.30.00
Vendor Advisory: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1708.html
Restart Required: Yes
Instructions:
1. Download patches from Rockwell Automation Security Advisory SD1708. 2. Apply FactoryTalk View SE 12.00.02 update. 3. Apply FactoryTalk Linx 6.30.00 update. 4. Restart affected systems and services. 5. Verify patch installation through version checks.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected systems from untrusted networks using firewalls and VLANs
Access Control Lists
allImplement strict network access controls to limit connections to FactoryTalk services
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems from all untrusted networks
- Deploy intrusion detection systems to monitor for exploitation attempts and database manipulation activities
🔍 How to Verify
Check if Vulnerable:
Check FactoryTalk View SE version (should be < 12.00.02) and FactoryTalk Linx version (should be < 6.30.00) through Rockwell Automation software management toolsCheck Version:
Use Rockwell Automation FactoryTalk Administration Console or check installed programs in Windows Control PanelVerify Fix Applied:
Verify FactoryTalk View SE version is 12.00.02 or higher and FactoryTalk Linx version is 6.30.00 or higher📡 Detection & Monitoring
Log Indicators:
- Unauthorized authentication attempts to FactoryTalk services
- Unexpected database modification events
- Unusual network connections to FactoryTalk ports
Network Indicators:
- Crafted messages to FactoryTalk services on default ports
- Unusual traffic patterns to/from industrial control systems
SIEM Query:
source="FactoryTalk" AND (event_type="authentication_failure" OR event_type="database_modification")