PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-37369 Rockwell Automation CVE debrief

A privilege escalation vulnerability in Rockwell Automation FactoryTalk View SE allows low-privilege users to edit scripts while bypassing Access Control Lists (ACLs), potentially enabling further system access. The vulnerability affects FactoryTalk View SE version 12.0 and was corrected in version 14.0. The issue was published by CISA on June 13, 2024.

Vendor
Rockwell Automation
Product
FactoryTalk View SE
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-06-13
Original CVE updated
2024-06-13
Advisory published
2024-06-13
Advisory updated
2024-06-13

Who should care

Organizations operating Rockwell Automation FactoryTalk View SE in industrial environments, particularly manufacturing, energy, and critical infrastructure sectors. Security teams responsible for OT/ICS security, system administrators managing HMI/SCADA deployments, and compliance officers overseeing industrial cybersecurity frameworks should prioritize this vulnerability due to its HIGH severity rating and potential for privilege escalation in control system environments.

Technical summary

The vulnerability exists in FactoryTalk View SE's script editing functionality, where insufficient access controls allow low-privilege users to modify scripts despite ACL restrictions. This bypass enables unauthorized code execution within the context of the application, potentially leading to further privilege escalation or system compromise. The local attack vector requires authenticated access but no user interaction, making it exploitable by any user with low-level credentials.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade to FactoryTalk View SE version 14.0 or later to obtain the correction for this vulnerability
  • If unable to upgrade immediately, apply risk mitigations as recommended by Rockwell Automation
  • Use the Secure Install option when installing FactoryTalk Services Platform
  • Follow Rockwell Automation security best practices for industrial control systems
  • Review and enforce principle of least privilege for all FactoryTalk View SE user accounts
  • Monitor for unauthorized script modifications in FactoryTalk View SE environments
  • Apply network segmentation to limit lateral movement if compromise occurs

Evidence notes

CISA CSAF advisory ICSA-24-165-17 identifies FactoryTalk View SE v12.0 as affected and confirms correction in v14.0. CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates local attack vector with low attack complexity, requiring low privileges but no user interaction, with high impact on confidentiality, integrity, and availability.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-37369 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-37369

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-37369 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-37369

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-165-17.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-17

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.