Rockwell Automation's FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies. Hard-coded cryptographic key may lead to privilege escalation. This vulnerability may allow a local, authenticated non-admin user to generate an invalid administrator cookie giving them administrative privileges to the FactoryTalk Policy Manger database. This may allow the threat actor to make malicious changes to the database that will be deployed when a legitimate FactoryTalk Policy Manager user deploys a security policy model. User interaction is required for this vulnerability to be successfully exploited.
References
| Link | Resource |
|---|---|
| https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139683 | Permissions Required Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
26 Jun 2023, 16:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:rockwellautomation:factorytalk_system_services:6.11.0:*:*:*:*:*:*:* cpe:2.3:a:rockwellautomation:factorytalk_policy_manager:6.11.0:*:*:*:*:*:*:* |
|
| CWE | CWE-798 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.2 |
| First Time |
Rockwellautomation
Rockwellautomation factorytalk System Services Rockwellautomation factorytalk Policy Manager |
|
| References | (MISC) https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139683 - Permissions Required, Vendor Advisory |
13 Jun 2023, 21:27
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-13 21:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-2637
Mitre link : CVE-2023-2637
CVE.ORG link : CVE-2023-2637
JSON object : View
Products Affected
rockwellautomation
- factorytalk_policy_manager
- factorytalk_system_services