Rockwell Automation FactoryTalk® Service Platform Service Token Vulnerability

CVE-2024-21917

Summary

A security vulnerability has been identified within Rockwell Automation's FactoryTalk Service Platform, which permits unauthorized access via the service token. The vulnerability arises from the absence of digital signature validation for the FTSP service token in relation to directories. An attacker exploiting this flaw could obtain the service token and use it to authenticate themselves on any other FTSP directory, resulting in unauthorized access to user data and the ability to modify critical settings without proper authentication. This poses a significant risk to the integrity and confidentiality of user information and operational settings within affected environments.

References