CVE-2024-37369
📋 TL;DR
This privilege escalation vulnerability allows low-privilege users to edit scripts and bypass Access Control Lists in Rockwell Automation products. This could enable attackers to gain elevated privileges and further access within industrial control systems. Organizations using affected Rockwell Automation software are at risk.
💻 Affected Systems
- Rockwell Automation FactoryTalk View Site Edition
📦 What is this software?
Factorytalk View by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control over industrial control systems, potentially enabling sabotage, data theft, or disruption of critical operations.
Likely Case
Malicious insiders or compromised low-privilege accounts escalate privileges to access sensitive systems, modify configurations, or install malware.
If Mitigated
With proper network segmentation and access controls, impact is limited to isolated systems with minimal operational disruption.
🎯 Exploit Status
Exploitation requires existing low-privilege access to the system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 13.0.0 or later
Vendor Advisory: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1674.html
Restart Required: Yes
Instructions:
1. Download FactoryTalk View Site Edition version 13.0.0 or later from Rockwell Automation. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart affected systems.
🔧 Temporary Workarounds
Restrict Script Editing Permissions
windowsManually adjust ACLs to prevent low-privilege users from editing scripts.
Implement Least Privilege Access
allReview and restrict user permissions to minimum required for their roles.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems from critical infrastructure
- Enhance monitoring and logging of script modification activities and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check FactoryTalk View Site Edition version in Control Panel > Programs and Features. Versions below 13.0.0 are vulnerable.Check Version:
wmic product where name="FactoryTalk View Site Edition" get versionVerify Fix Applied:
Verify version is 13.0.0 or higher and test that low-privilege users cannot edit scripts.📡 Detection & Monitoring
Log Indicators:
- Unexpected script file modifications
- Privilege escalation attempts
- Unauthorized access to administrative functions
Network Indicators:
- Unusual network traffic from low-privilege accounts to sensitive systems
SIEM Query:
EventID=4688 AND (ProcessName LIKE "%script%" OR CommandLine LIKE "%edit%") AND SubjectUserName NOT IN (admin_users_list)