Improper Verification of Cryptographic Signature in FactoryTalk Services Platform - CVE-2024-21917

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the lack of digital signing between the FTSP service token and directory. A remote attacker can obtain the service token and use it for authentication on another FTSP directory.

Affected software

How to mitigate CVE-2024-21917

External References

• https://www.rockwellautomation.com/en-us/support/advisory.SD1660.html
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-06

Related Security Bulletins

• Improper Verification of Cryptographic Signature in Rockwell Automation FactoryTalk Service Platform