CVE-2024-21915: rockwell automation factorytalk® service platform

Vulnerability summary

CVE-2024-21915 is a critical (CVSS 9.0) vulnerability in rockwell automation factorytalk® service platform. EPSS estimates a 0.99% chance of exploitation in the next 30 days, higher than 62.1% of scored vulnerabilities.

Timeline

1. 16-02-2024
   PublishedVulnerability first disclosed.
2. 28-08-2024
   Last modifiedVulnerability information updated.

Description

A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform (FTSP). If exploited, a malicious user with basic user group privileges could potentially sign into the software and receive FTSP Administrator Group privileges. A threat actor could potentially read and modify sensitive data, delete data and render the FTSP system unavailable.

• CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.