Privilege escalation in Rockwell Automation Factorytalk® Policy Manager (Ftpm)
CVE-2024-6326
An exposure of sensitive information vulnerability exists in the Rockwell Automation FactoryTalk® System Service. A malicious user could exploit this vulnerability by starting a back-up or restore process, which temporarily exposes private keys, passwords, pre-shared keys, and database folders when they are temporarily copied to an interim folder. This vulnerability is due to the lack of explicit permissions set on the backup folder. If private keys are obtained by a malicious user, they could impersonate resources on the secured network.
Vulnerability class: Privilege Escalation
EPSS: 0.002 (7.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Rockwell Automation Factorytalk® Policy Manager (Ftpm) — versions v6.40
- Rockwell Automation Factorytalk® System Services (Installed Via Ftpm) — versions v6.40
- Rockwellautomation Factorytalk_policy_manager — versions 6.40.0
- Rockwellautomation Factorytalk_system_services — versions 6.40.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- PSIRT@rockwellautomation.com (Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-6326?
- CVE-2024-6326 is a medium-severity vulnerability in Rockwell Automation Factorytalk® Policy Manager (Ftpm), classified under Improper Privilege Management. CVSS score: 5.5/10. Published 2024-07-16.
- How severe is CVE-2024-6326?
- Medium severity. CVSS v3 base score is 5.5 out of 10.
- Is CVE-2024-6326 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.