CVE-2021-32960 : What You Need to Know
Learn about CVE-2021-32960 affecting Rockwell Automation's FactoryTalk Services Platform versions prior to 6.11. Find out the impact, technical details, and mitigation strategies here.
This article is about a vulnerability identified as CVE-2021-32960 in Rockwell Automation's FactoryTalk Services Platform, affecting versions prior to 6.11. The vulnerability allows a remote attacker to bypass security policies.
Understanding CVE-2021-32960
This section provides insights into the nature and impact of the CVE-2021-32960 vulnerability.
What is CVE-2021-32960?
The vulnerability in Rockwell Automation's FactoryTalk Services Platform, versions 6.11 and earlier, enables a remote authenticated attacker to bypass security policies based on the computer name. This could grant the attacker privileges equivalent to being logged onto the client machine.
The Impact of CVE-2021-32960
The vulnerability poses a high risk with a CVSS base score of 8.5, impacting confidentiality, integrity, and availability of the affected systems.
Technical Details of CVE-2021-32960
This section delves into the technical aspects of the CVE-2021-32960 vulnerability.
Vulnerability Description
The vulnerability in FactoryTalk Services Platform allows malicious actors to circumvent security policies, potentially leading to unauthorized access.
Affected Systems and Versions
Rockwell Automation's FactoryTalk Services Platform versions earlier than 6.11 are vulnerable to this exploit.
Exploitation Mechanism
The vulnerability arises from a flaw in FactoryTalk Security that can be exploited remotely by authenticated attackers.
Mitigation and Prevention
This section outlines measures to mitigate and prevent the exploitation of CVE-2021-32960.
Immediate Steps to Take
Users are advised to update to FactoryTalk Services Platform v6.20 or later. For those unable to update immediately, risk mitigation strategies are provided.
Long-Term Security Practices
To enhance security in the long term, it is recommended to run software as a user, follow the principle of least privilege, and use secure remote access methods.
Patching and Updates
Regularly updating software, implementing security best practices, and monitoring for atypical activities are crucial to safeguard systems.