CVE-2024-10945 Rockwell Automation CVE debrief

Who should care

Organizations operating Rockwell Automation FactoryTalk Updater in industrial environments, particularly those in manufacturing, critical infrastructure, and operational technology (OT) sectors. System administrators responsible for patch management in ICS/SCADA environments, security teams overseeing OT/IT convergence, and compliance officers managing NERC CIP or IEC 62443 requirements should prioritize assessment. The local attack vector makes this especially relevant for multi-user systems or environments with shared workstation access.

Technical summary

The vulnerability exists in the update mechanism of FactoryTalk Updater components, where insufficient security checks before installation allow a low-privileged local attacker to replace certain files during the update process. This failure to validate file integrity or authenticity before installation execution creates a race condition or substitution opportunity that can be exploited for privilege escalation. The attack requires local access (AV:L), low attack complexity (AC:L), low privileges (PR:L), and user interaction (UI:R), but successful exploitation yields high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The Web Client component is specifically affected in the 4.00.00 to 4.20.00 version range, while Client and Agent components are affected in all versions below 4.20.00.

Defensive priority

HIGH

Recommended defensive actions

• Upgrade FactoryTalk Updater - Web Client to version 4.20.00 or later
• Upgrade FactoryTalk Updater - Client to version 4.20.00 or later
• Upgrade FactoryTalk Updater - Agent to version 4.20.00 or later
• Restrict physical and logical access to servers running FactoryTalk Updater
• Perform database updates by clicking the 'Scan' button after patching
• Review Rockwell Automation security best practices for industrial control systems
• Apply Stakeholder-Specific Vulnerability Categorization (SSVC) for environment-specific prioritization

Evidence notes

CISA CSAF advisory ICSA-24-319-14 identifies three affected product variants: FactoryTalk Updater - Web Client (CSAFPID-0001, versions >=4.00.00|<4.20.00), FactoryTalk Updater - Client (CSAFPID-0002, versions <4.20.00), and FactoryTalk Updater - Agent (CSAFPID-0003, versions <4.20.00). The vulnerability stems from missing security checks during update installation, allowing file replacement by low-privileged local actors. CVSS 3.1 vector: AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

Official resources