Medium severity · published Jul 16, 2024
CVE-2024-6326
Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
An exposure of sensitive information vulnerability exists in the Rockwell Automation FactoryTalk® System Service. A malicious user could exploit this vulnerability by starting a back-up or restore process, which temporarily exposes private keys, passwords, pre-shared keys, and database folders when they are temporarily copied to an interim folder. This vulnerability is due to the lack of explicit permissions set on the backup folder. If private keys are obtained by a malicious user, they could impersonate resources on the secured network.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FP
FactoryTalk® Policy Manager (FTPM) · Rockwell Automation
v6.40 · source: vendor
FS
FactoryTalk® System Services (installed via FTPM) · Rockwell Automation
v6.40 · source: vendor
FP
Factorytalk Policy Manager · Rockwellautomation
6.40.0 · source: NVD
FS
Factorytalk System Services · Rockwellautomation
6.40.0 · source: NVD
Affected product
FP
FactoryTalk® Policy Manager (FTPM)
Rockwell Automation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6326
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6326
Mitigation
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1678.html
More from FactoryTalk® Policy Manager (FTPM)
6.5
CVE-2024-6325
Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services
