CVE-2024-45823
📋 TL;DR
CVE-2024-45823 is an authentication bypass vulnerability in Rockwell Automation products where shared secrets across accounts allow threat actors to impersonate users if they can enumerate additional authentication information. This affects Rockwell Automation systems using vulnerable authentication mechanisms. Organizations using affected Rockwell products should prioritize patching.
💻 Affected Systems
- Rockwell Automation FactoryTalk products
📦 What is this software?
Factorytalk Batch View by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing unauthorized access to industrial control systems, potential manipulation of physical processes, data theft, and operational disruption.
Likely Case
Unauthorized access to user accounts leading to data exposure, configuration changes, and limited system manipulation depending on user privileges.
If Mitigated
Limited impact with proper network segmentation, monitoring, and compensating controls preventing successful exploitation.
🎯 Exploit Status
Requires enumeration of additional authentication information beyond just shared secrets
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched versions
Vendor Advisory: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201698.html
Restart Required: Yes
Instructions:
1. Review vendor advisory SD 1698. 2. Identify affected products and versions. 3. Apply vendor-provided patches. 4. Restart affected systems. 5. Verify patch application.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected systems from untrusted networks and implement strict access controls
Enhanced Monitoring
allImplement strict authentication logging and monitoring for suspicious access patterns
🧯 If You Can't Patch
- Implement network segmentation to isolate affected systems
- Enable detailed authentication logging and monitor for suspicious access patterns
🔍 How to Verify
Check if Vulnerable:
Check system version against vendor advisory and verify if using FactoryTalk authentication with shared secretsCheck Version:
Check FactoryTalk version through product interface or vendor documentationVerify Fix Applied:
Verify patch version installed matches vendor recommendations and test authentication mechanisms📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful login from unusual locations
- Authentication events showing shared secret usage patterns
Network Indicators:
- Unusual authentication traffic patterns
- Access attempts from unauthorized IP ranges
SIEM Query:
Authentication logs where source_ip NOT IN allowed_ranges AND authentication_method='shared_secret'