193 lines
14 KiB
JSON
193 lines
14 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2024-6325",
|
||
"assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Rockwell",
|
||
"dateReserved": "2024-06-25T15:13:41.907Z",
|
||
"datePublished": "2024-07-16T16:43:44.494Z",
|
||
"dateUpdated": "2024-08-01T21:33:05.423Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "FactoryTalk® System Services (installed via FTPM)",
|
||
"vendor": "Rockwell Automation",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "6.40"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "FactoryTalk® Policy Manager (FTPM)",
|
||
"vendor": "Rockwell Automation",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "v6.40"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"datePublic": "2024-07-11T13:00:00.000Z",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">The v6.40 release of Rockwell Automation FactoryTalk® Policy Manager</span><a target=\"_blank\" rel=\"nofollow\"> allowed </a><span style=\"background-color: rgb(255, 255, 255);\">the private keys to be insecurely stored with read and execute privileges for the Windows group, ‘Everyone’. These keys are used to generate digital certificates and pre-shared keys. This vulnerability could allow a malicious user with access to the machine to obtain private keys. If obtained, a malicious user could impersonate resources on the secured network. </span><a target=\"_blank\" rel=\"nofollow\"></a><a target=\"_blank\" rel=\"nofollow\"></a><a target=\"_blank\" rel=\"nofollow\"></a><a target=\"_blank\" rel=\"nofollow\"></a><a target=\"_blank\" rel=\"nofollow\">For customers</a><span style=\"background-color: rgb(255, 255, 255);\"> using FactoryTalk® Policy Manager v6.40 who mitigated</span><a target=\"_blank\" rel=\"nofollow\"></a><a target=\"_blank\" rel=\"nofollow\"> </a><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html\">CVE-2021-22681</a><span style=\"background-color: rgb(255, 255, 255);\"> and </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html\">CVE-2022-1161</a><span style=\"background-color: rgb(255, 255, 255);\"> by implementing CIP security and did not update to the versions of the software</span><a target=\"_blank\" rel=\"nofollow\"> </a><span style=\"background-color: rgb(255, 255, 255);\">that contain the remediation, this vulnerability could allow a threat actor to exploit </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html\">CVE-2022-1161</a><span style=\"background-color: rgb(255, 255, 255);\"> and </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html\">CVE-2022-1161.</a>\n\n"
|
||
}
|
||
],
|
||
"value": "The v6.40 release of Rockwell Automation FactoryTalk® Policy Manager CVE-2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and CVE-2022-1161 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html by implementing CIP security and did not update to the versions of the software CVE-2022-1161 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html and CVE-2022-1161. https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html"
|
||
}
|
||
],
|
||
"impacts": [
|
||
{
|
||
"capecId": "CAPEC-122",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CAPEC-122 Privilege Abuse"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV4_0": {
|
||
"Automatable": "NOT_DEFINED",
|
||
"Recovery": "NOT_DEFINED",
|
||
"Safety": "NOT_DEFINED",
|
||
"attackComplexity": "LOW",
|
||
"attackRequirements": "NONE",
|
||
"attackVector": "LOCAL",
|
||
"baseScore": 6,
|
||
"baseSeverity": "MEDIUM",
|
||
"privilegesRequired": "LOW",
|
||
"providerUrgency": "NOT_DEFINED",
|
||
"subAvailabilityImpact": "NONE",
|
||
"subConfidentialityImpact": "HIGH",
|
||
"subIntegrityImpact": "NONE",
|
||
"userInteraction": "NONE",
|
||
"valueDensity": "NOT_DEFINED",
|
||
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
|
||
"version": "4.0",
|
||
"vulnAvailabilityImpact": "NONE",
|
||
"vulnConfidentialityImpact": "NONE",
|
||
"vulnIntegrityImpact": "NONE",
|
||
"vulnerabilityResponseEffort": "NOT_DEFINED"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-269",
|
||
"description": "CWE-269 Improper Privilege Management",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "b73dd486-f505-4403-b634-40b078b177f0",
|
||
"shortName": "Rockwell",
|
||
"dateUpdated": "2024-07-16T16:43:44.494Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1678.html"
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "\n\n<p>Users using the affected software are encouraged to implement the following steps to invalidate the existing vulnerable private keys/digital certificates and regenerate new secure ones.</p><p><a target=\"_blank\" rel=\"nofollow\"></a><a target=\"_blank\" rel=\"nofollow\"></a><a target=\"_blank\" rel=\"nofollow\"></a><a target=\"_blank\" rel=\"nofollow\">· Clear CIP Security configurations from devices and from FactoryTalk® Policy Manager</a></p><p>· Update FactoryTalk® System Services and FactoryTalk® Policy Manager to v6.40.01</p><p>· Redeploy CIP Security Policy </p><p>Detailed steps are below <b>(FactoryTalk System Services (FTSS) is updated through the installation of FactoryTalk Policy Manager (FTPM)</b></p><p>1) Remove deployed security policy from all devices using FactoryTalk® Policy Manager (FTPM):</p><p>a. Open FTPM.</p><p>b. Document all Zone’s security settings and all Conduit’s settings as you must re-create them after updating FTPM.</p><p>c. Change all devices port’s Policies > Zone values to the “Unassigned” Zone.</p><p>d. Delete all zones and conduits.</p><p>e. Deploy (CIP). Ensure that all endpoints were reset successfully.</p><p>f. [migrating from v6.40 only] Deploy (OPC UA). Ensure all endpoints were reset successfully.</p><p> i. For any OPC UA clients, perform whatever steps are required by those clients to remove the previously applied certificates.</p><p>g. Close FTPM</p><p>2) Delete the \\FTSS_backup folder:</p><p>a. c:\\ProgramData\\Rockwell\\RNAServer\\Global\\RnaStore\\FTSS_Backup</p><p>3) Delete the \\keystore folder:</p><p>a. c:\\ProgramData\\Rockwell Automation\\FactoryTalk System Services\\keystore</p><p>4) Delete any backup copies of the \\keystore folder. They will be named the same as the \\keystore folder but with a suffix appended to it, like:</p><p>a. c:\\ProgramData\\Rockwell Automation\\FactoryTalk System Services\\ keystore_source_2024_04_25_12_25_38_541566</p><p>5) Delete the PSKs.json file:</p><p>a. c:\\ProgramData\\Rockwell Automation\\FactoryTalk System Services\\PSKs.json</p><p>6) Delete any backup copies of the PSKs.json file. They will be named the same as the PSKs.json file but with a suffix appended to it, like:</p><p>a. c:\\ProgramData\\Rockwell Automation\\FactoryTalk System Services\\ PSKs.json_source_2024_05_17_07_38_25_200356</p><p>7) Install FactoryTalk® Policy Manager version 6.40.01.</p><p>a. Restart the computer when prompted at the end of the install.</p><p>8) Open FTPM. FTPM will attempt to connect to the FactoryTalk® System Services web server before proceeding.</p><p>9) If FTPM could not successfully connect to FactoryTalk® System Services (FTSS), it is because the FTSS service hasn’t started yet. It will eventually start or else you can start the FTSS service manually in Windows Services.</p><p>10) Re-create the original Zones.</p><p>11) Move the devices from the unassigned Zone back to their original zones.</p><p>12) Re-create the original Conduits.</p><p>13) Deploy (CIP endpoints).</p><p>14) [migrating from v6.40 only] Deploy (OPC UA endpoints).</p><p>a. For any OPC UA client endpoints, manually apply the newly generated certificates from this deploy.</p><p>Additionally, we encourage customers to implement our suggested security best practices to minimize the risk of vulnerability.</p><p>· <a target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight\">Security Best Practices</a></p>\n\n<br>"
|
||
}
|
||
],
|
||
"value": "Users using the affected software are encouraged to implement the following steps to invalidate the existing vulnerable private keys/digital certificates and regenerate new secure ones.\n\n Security Best Practices https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight"
|
||
}
|
||
],
|
||
"source": {
|
||
"advisory": "SD1678",
|
||
"discovery": "INTERNAL"
|
||
},
|
||
"title": "Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2024-07-16T18:04:54.518272Z",
|
||
"id": "CVE-2024-6325",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-07-17T15:47:32.018Z"
|
||
}
|
||
},
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-01T21:33:05.423Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1678.html",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
} |