PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-4609 Rockwell Automation CVE debrief

A SQL injection vulnerability in Rockwell Automation FactoryTalk View SE's Datalog function allows authenticated threat actors to inject malicious SQL statements when databases lack authentication or credentials are compromised. The flaw affects HMI design-time operations only, not runtime. Successful exploitation enables information disclosure, data modification, and deletion in remote databases. The vulnerability was disclosed on May 16, 2024, with a CVSS 3.1 score of 7.6 (HIGH). Affected versions are prior to 14.0. Rockwell Automation has released version 14.0 as the remediation.

Vendor
Rockwell Automation
Product
FactoryTalk View SE
CVSS
HIGH 7.6
CISA KEV
Not listed in stored evidence
Original CVE published
2024-05-16
Original CVE updated
2024-05-16
Advisory published
2024-05-16
Advisory updated
2024-05-16

Who should care

Organizations operating Rockwell Automation FactoryTalk View SE in industrial environments, particularly those using the Datalog function with SQL databases. Critical infrastructure operators, manufacturing facilities, and OT security teams should prioritize assessment and patching.

Technical summary

The FactoryTalk View SE Datalog function constructs SQL queries without adequate input sanitization, enabling injection of malicious SQL statements. Exploitation requires either an unauthenticated SQL database or stolen legitimate credentials. The vulnerability is network-accessible with low attack complexity and low privileges required. Impact includes high confidentiality loss (sensitive information exposure), low integrity loss (data modification), and low availability loss (data deletion). Scope is limited to HMI design-time operations; runtime systems are unaffected. CVSS 3.1: 7.6 (HIGH). CVSS 4.0: 8.7 (HIGH).

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade FactoryTalk View SE to version 14.0 or later to remediate this vulnerability
  • Ensure SQL databases used with FactoryTalk View SE Datalog function require strong authentication
  • Audit and rotate credentials for SQL database connections to prevent credential-based exploitation
  • Restrict network access to FactoryTalk View SE systems and associated SQL databases to authorized personnel only
  • Monitor for anomalous SQL queries or database access patterns that may indicate exploitation attempts
  • Review and apply CISA ICS recommended practices for securing industrial control systems
  • Consult Rockwell Automation security bulletin for additional mitigation guidance

Evidence notes

CISA ICS advisory ICSA-24-137-14 published 2024-05-16 confirms SQL injection in FactoryTalk View SE Datalog function affecting versions <14.0. CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L yields score 7.6. Attack scope limited to HMI design time per vendor disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-4609 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-4609

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-4609 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-4609

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-137-14.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-137-14

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.