CVE-2024-4609
📋 TL;DR
This SQL injection vulnerability in Rockwell Automation FactoryTalk View SE Datalog function allows attackers to execute malicious SQL statements if database authentication is missing or credentials are compromised. Exploitation could lead to data exposure, modification, or deletion in remote databases. Only affects HMI design time environments, not runtime operations.
💻 Affected Systems
- Rockwell Automation FactoryTalk View SE
📦 What is this software?
Factorytalk View by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of SQL database with data theft, modification, or deletion, potentially affecting operational integrity if sensitive configuration data is altered.
Likely Case
Information disclosure of sensitive HMI configuration data and potential data manipulation in poorly secured environments.
If Mitigated
Minimal impact with proper database authentication and network segmentation in place.
🎯 Exploit Status
Exploitation requires either no database authentication or compromised credentials. SQL injection is a well-understood attack vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v12.00.02
Vendor Advisory: https://www.rockwellautomation.com/en-us/support/advisory.SD1670.html
Restart Required: Yes
Instructions:
1. Download FactoryTalk View SE v12.00.02 from Rockwell Automation support portal. 2. Backup current configuration. 3. Install the update following vendor documentation. 4. Restart affected systems.
🔧 Temporary Workarounds
Implement SQL Database Authentication
allConfigure strong authentication for all SQL databases used by FactoryTalk View SE
Network Segmentation
allIsolate FactoryTalk View SE systems from untrusted networks and implement firewall rules
🧯 If You Can't Patch
- Implement strict database authentication with strong credentials
- Segment network to restrict access to FactoryTalk View SE systems and databases
🔍 How to Verify
Check if Vulnerable:
Check FactoryTalk View SE version in software properties. Versions below v12.00.02 are vulnerable.Check Version:
Check via Windows Programs and Features or FactoryTalk View SE About dialogVerify Fix Applied:
Verify version is v12.00.02 or higher in software properties and test SQL database connections with authentication.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Failed authentication attempts to SQL databases
- Unexpected database modifications
Network Indicators:
- SQL traffic from unexpected sources to FactoryTalk View SE systems
- Unusual database connection patterns
SIEM Query:
source="database_logs" AND ("sql injection" OR "malicious query" OR "unauthorized access") AND dest="factorytalk_sql_server"