PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-22019 Rockwell Automation CVE debrief

Rockwell Automation FactoryTalk Policy Manager is affected by CVE-2024-22019, a network-reachable denial-of-service issue in Node.js HTTP server handling of chunked encoding. According to the CISA CSAF advisory, a specially crafted HTTP request can cause the server to read an unbounded number of bytes from a single connection via chunk extension processing, which can exhaust CPU and network bandwidth and bypass common safeguards such as timeouts and body-size limits. Rockwell Automation states the issue is corrected in software Version 6.60.00 and later. The supplied corpus does not indicate KEV listing, known ransomware use, or exploit details beyond the advisory description, so the main defensive focus should be prompt patching and limiting exposure of the affected service.

Vendor
Rockwell Automation
Product
FactoryTalk Policy Manager
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-11-13
Original CVE updated
2025-11-13
Advisory published
2025-11-13
Advisory updated
2025-11-13

Who should care

Industrial control system defenders, Rockwell Automation FactoryTalk Policy Manager administrators, OT security teams, and anyone responsible for exposed or broadly reachable Node.js-based management services in industrial environments.

Technical summary

CVE-2024-22019 is a denial-of-service vulnerability with CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue is described as an unbounded-read condition in chunked HTTP request processing, where a crafted request can drive resource exhaustion on a single connection. The impact is availability-only, but the attack is reachable over the network and requires no privileges or user interaction.

Defensive priority

High: the issue is network-reachable, requires no authentication, and can exhaust service resources. Prioritize upgrading exposed or business-critical FactoryTalk Policy Manager deployments.

Recommended defensive actions

  • Upgrade Rockwell Automation FactoryTalk Policy Manager to Version 6.60.00 or later, as stated in the advisory.
  • If you cannot upgrade immediately, follow Rockwell Automation security best practices and contact TechConnect for guidance.
  • Reduce exposure of the affected service by limiting access to trusted administrators and networks only.
  • Monitor the service for unusual resource exhaustion or repeated HTTP chunked-transfer traffic that could indicate abuse of the affected code path.

Evidence notes

Source evidence comes from the CISA CSAF advisory ICSA-25-317-09 for Rockwell Automation FactoryTalk Policy Manager, published 2025-11-13 with initial revision 1. The advisory describes a chunked-encoding HTTP denial-of-service condition and lists remediation as Version 6.60.00 and later. The supplied corpus shows CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and no KEV, ransomware, or exploit-prevalence fields populated.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-22019 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-22019

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-22019 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-22019

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-317-09.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-09

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.