Critical Vulnerabilities Found in Rockwell Automation's DataMosaix Private Cloud

In a world increasingly reliant on digital infrastructure, vulnerabilities in software can lead to significant risks, especially when they concern critical manufacturing sectors. Recently, cybersecurity experts identified vulnerabilities in Rockwell Automation's DataMosaix Private Cloud that have sent ripples through the industry. With a CVSS v4 score of 8.7, these defects demand immediate attention from organizations that utilize this technology.

1. Executive Summary​

The vulnerabilities attributed to the DataMosaix Private Cloud, particularly versions 7.07 and earlier, allow for remote exploitation with low complexity. Attackers could potentially gain unauthorized access to sensitive user data or manipulate projects entirely. The three major vulnerabilities include:

• CWE-200: Exposure of Sensitive Information to Unauthorized Actors.
• CWE-862: Missing Authorization.
• CWE-863: Incorrect Authorization.

These vulnerabilities demonstrate how essential it is to stay ahead of potential threats, particularly in software that manages vital industrial processes.

2. Risk Evaluation​

Successful exploitation of these vulnerabilities can have far-reaching consequences, allowing attackers not only to view confidential user data but also to create, modify, or delete projects. In scenarios where manufacturing systems are targeted, the ramifications could disrupt production lines, leading to financial losses and damage to reputation.

3. Technical Details​

3.1 Affected Products​

Rockwell Automation specifically reported that the following versions of the DataMosaix Private Cloud are at risk:

• DataMosaix Private Cloud, Versions 7.07 and earlier.

3.2 Vulnerability Overview​

3.2.1 CWE-200: Exposure of Sensitive Information​

A data exposure vulnerability exists due to hardcoded links in the source code leading to JSON files that can be accessed without authentication. The assigned CVE-2024-7952 has a CVSS v3.1 score of 7.5 and a v4 score of 8.7, emphasizing the critical nature of this risk.

3.2.2 CWE-862: Missing Authorization​

This vulnerability allows unauthorized individuals to create projects and assume administrative control without the required permissions. CVE-2024-7953 shows a v3.1 score of 8.8, underscoring its severity.

3.2.3 CWE-863: Incorrect Authorization​

A lower-tier threat that permits users with basic privileges to access and manipulate projects, CVE-2024-7956 has a v3.1 score of 8.1, indicating it is still significant but somewhat less critical than the others.

3.3 Background​

The implications extend beyond mere data theft, affecting Critical Manufacturing sectors globally, highlighting the architecture’s reach. The headquarters of Rockwell Automation being in the United States adds another layer of scrutiny, as domestic vulnerabilities can have international ramifications.

3.4 Researcher​

Rockwell Automation reported these vulnerabilities to the Cybersecurity and Infrastructure Security Agency (CISA), indicating a proactive approach to rectifying these issues.

4. Mitigations​

Rockwell Automation has already addressed these vulnerabilities in the latest software release (version 7.09) and encourages users to upgrade promptly. For those unable to update, applying robust security best practices is crucial to minimize potential risks. Recommended mitigations include:

• Ensuring that control system devices and networks are not exposed to the internet.
• Isolating control systems from business networks by placing them behind firewalls.
• Implementing secure remote access through updated VPNs.

CISA's Recommendations:​

• Conducting a proper impact analysis and risk assessment prior to implementing new defensive measures is essential.
• Organizations are advised to engage in active monitoring and reporting of any suspicious activities to CISA for tracking and mitigating risks.

5. Update History​

• October 10, 2024: Initial publication outlining these vulnerabilities and their associated risks.

In this digitally driven age, the only way forward is through vigilance and responsibility. By understanding vulnerabilities within systems like Rockwell Automation's DataMosaix, organizations can act preemptively, ensuring they remain resilient against evolving cyber threats.
Stay informed, stay secure, and keep those critical infrastructure systems safe! If you've experienced any interactions with these vulnerabilities or have further insights,please share your thoughts below.
Source: CISA Rockwell Automation DataMosaix Private Cloud