CVE-2024-6326

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-6326
An exposure of sensitive information vulnerability exists in the Rockwell Automation FactoryTalk® System Service. A malicious user could exploit this vulnerability by starting a back-up or restore process, which temporarily exposes private keys, passwords, pre-shared keys, and database folders when they are temporarily copied to an interim folder. This vulnerability is due to the lack of explicit permissions set on the backup folder. If private keys are obtained by a malicious user, they could impersonate resources on the secured network.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1678.html Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:rockwellautomation:factorytalk_policy_manager:6.40.0:*:*:*:*:*:*:*
cpe:2.3:a:rockwellautomation:factorytalk_system_services:6.40.0:*:*:*:*:*:*:*
History

23 Sep 2024, 17:02

Type Values Removed Values Added
First Time Rockwellautomation
Rockwellautomation factorytalk System Services
Rockwellautomation factorytalk Policy Manager
CWE CWE-276
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1678.html - () https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1678.html - Mitigation, Vendor Advisory
Summary
  • (es) Existe una exposición de vulnerabilidad de información confidencial en el servicio del sistema FactoryTalk® de Rockwell Automation. Un usuario malintencionado podría aprovechar esta vulnerabilidad iniciando un proceso de copia de seguridad o restauración, que expone temporalmente claves privadas, contraseñas, claves previamente compartidas y carpetas de bases de datos cuando se copian temporalmente en una carpeta provisional. Esta vulnerabilidad se debe a la falta de permisos explícitos establecidos en la carpeta de respaldo. Si un usuario malintencionado obtiene claves privadas, podría hacerse pasar por recursos en la red segura.
CPE cpe:2.3:a:rockwellautomation:factorytalk_system_services:6.40.0:*:*:*:*:*:*:*
cpe:2.3:a:rockwellautomation:factorytalk_policy_manager:6.40.0:*:*:*:*:*:*:*

16 Jul 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-16 17:15

Updated : 2024-09-23 17:02

NVD link : CVE-2024-6326

Mitre link : CVE-2024-6326

CVE.ORG link : CVE-2024-6326

JSON object : View

Products Affected

rockwellautomation

  • factorytalk_system_services
  • factorytalk_policy_manager
CWE
CWE-276

Incorrect Default Permissions

CWE-269

Improper Privilege Management