Critical ICS Vulnerability in Rockwell Automation's FactoryTalk View ME: What You Need to Know

In an increasingly interconnected world, the security of industrial control systems (ICS) remains paramount. Recent developments in cybersecurity have spotlighted a significant vulnerability within Rockwell Automation's FactoryTalk View ME that demands immediate attention.

Executive Summary​

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory regarding a critical security vulnerability in FactoryTalk View ME, a software used extensively in industrial environments. Here's a glimpse of the risk evaluation:

• CVSS Score: 7.0 (based on CVSS v4)
• Vulnerability Type: Improper Input Validation
• Vendor: Rockwell Automation
• Affected Versions: FactoryTalk View ME v14.0 and earlier, particularly when using default folder privileges.

A Low Complexity Attack: The nature of this vulnerability is insidious, requiring minimal technical ability, allowing a low-privileged local user to escalate their privileges and potentially execute arbitrary code through altered macros.

Risk Evaluation​

The core risk associated with this vulnerability resides in the potential for local privilege escalation. If successfully exploited, a user, even with low privileges, could manipulate macros to run unauthorized code. This could lead to significant operational risks, particularly in environments managing critical infrastructure.

Technical Details​

Affected Products​

Rockwell Automation has identified that FactoryTalk View ME, particularly versions compliant under the default privilege settings (v14.0 and prior), are susceptible to exploitation.

Understanding the Vulnerability​

Known as CVE-2024-37365, the flaw allows users to save sensitive projects in publicly accessible directories. Should an adversary gain local access, they could alter or delete vital files. Detailed analysis reveals:

• A specific class of vulnerability termed Improper Input Validation (CWE-20) is at play.
• A CVSS v3.1 base score of 7.3 indicates a high severity—akin to a locked door with a flimsy lock.

Background Insights​

The implications of this vulnerability are felt within the Critical Manufacturing sector and deployed globally. With head offices based in the United States, Rockwell Automation's products extend across various industries, making this flaw particularly impactful.

Mitigations Recommended​

Rockwell Automation has made strides in encapsulating the vulnerability in their V15.0 release. However, for those unable to upgrade, they provide these crucial mitigation strategies:

1. Harden Windows OS Security: Remove the INTERACTIVE group from security properties on relevant folders to bolster defenses against unauthorized modifications.
2. Implement Least Privilege Principle: Add specific users or groups to manage permissions carefully, ensuring that read-only permissions allow for necessary functionalities without opening vulnerabilities.
3. System Configuration Guidance: Reference the FactoryTalk View ME help topics for specific instructions on project folder settings.
4. Adhere to Security Best Practices: Follow guidelines set forth by Rockwell Automation.

CISA Defensive Measures​

In conjunction, CISA lays down further recommendations:

• Limit network exposure for all control devices, ensuring they’re not internet-accessible.
• Deploy firewalls to isolate control networks from business networks.
• Enforce secure remote access protocols, opting for VPN where necessary.

Conclusion and Next Steps​

Organizations utilizing Rockwell Automation’s FactoryTalk View ME should take this advisory seriously. Implement mitigation strategies promptly to safeguard against potential exploitation. The absence of confirmed public exploitation does not detract from the urgency of the situation.
The CISA and Rockwell Automation security advisories provide detailed guidance for implementing these defenses. Always embark on a thorough impact analysis and risk assessment before deploying security measures.

Update History​

• November 12, 2024: Initial publication of advisories regarding the vulnerability.

With the rapid evolution of cybersecurity threats, staying informed, and proactively defending systems can mean the difference between operational efficiency and catastrophic downtime. Be vigilant, stay updated, and protect your infrastructure.

---

Source: CISA Rockwell Automation FactoryTalk View ME