CVE-2024-21914: Rockwellautomation Factorytalk View DOS Vulnerability

CVE-2024-21914 is a denial of service vulnerability in Rockwellautomation Factorytalk View affecting PanelView Plus 7 terminals. Attackers can remotely restart devices, causing loss of view or control. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2024-21914 Overview

CVE-2024-21914 affects Rockwell Automation FactoryTalk View Machine Edition running on PanelView Plus 7 terminals. The vulnerability allows an unauthenticated remote attacker to restart the terminal without triggering security protections. Successful exploitation can cause a loss of view or loss of control of the human-machine interface (HMI), disrupting operator visibility into industrial processes.

The issue is categorized under [CWE-400] Uncontrolled Resource Consumption and impacts operational technology (OT) environments where availability is critical. Rockwell Automation published Security Advisory SD1663 describing the flaw and mitigation guidance.

Critical Impact
An unauthenticated network attacker can remotely restart a PanelView Plus 7 terminal, causing operators to lose view or control of the connected industrial process.

Affected Products

Rockwell Automation FactoryTalk View Machine Edition
Rockwell Automation PanelView Plus 7 terminals
Deployments exposing the HMI to reachable network segments

Discovery Timeline

2024-03-25 - CVE-2024-21914 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD

Technical Details for CVE-2024-21914

Vulnerability Analysis

The vulnerability resides in the network-facing services of the PanelView Plus 7 terminal running FactoryTalk View Machine Edition. A malicious actor with network reachability to the device can issue a restart request that the terminal processes without enforcing authentication or authorization checks.

Because the restart function does not validate the requesting principal, an attacker can trigger the operation repeatedly. Each restart interrupts the HMI, temporarily removing operator visibility into the underlying industrial process. In safety-sensitive OT environments, loss of view or control can force plant operators to fall back on manual procedures or shut down production lines.

Root Cause

The root cause is missing security enforcement on a privileged terminal function. The restart operation is exposed on the network without the authentication controls required to protect an availability-impacting action. This aligns with [CWE-400] Uncontrolled Resource Consumption, as the attacker can consume the availability of the HMI at will.

Attack Vector

Exploitation requires network access to the PanelView Plus 7 terminal. No user interaction and no prior privileges are required. In flat OT networks or in environments where enterprise and control networks are not properly segmented, an attacker who reaches the HMI subnet can send crafted restart requests directly.

Rockwell Automation has not published a public proof-of-concept, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Full technical specifics are restricted to the vendor advisory. See the Rockwell Automation Security Advisory SD1663 for authoritative details.

Detection Methods for CVE-2024-21914

Indicators of Compromise

Unexpected restart events or reboot cycles recorded on PanelView Plus 7 terminals
Gaps in HMI telemetry or historian data that align with terminal outages
Network connections to FactoryTalk View services from hosts outside the approved engineering workstation set

Detection Strategies

Baseline normal restart frequency for each HMI and alert on deviations
Correlate HMI availability events with upstream network traffic to identify the source of restart requests
Monitor for scanning or repeated connection attempts against FactoryTalk View network services on the OT segment

Monitoring Recommendations

Forward PanelView and FactoryTalk View system logs to a centralized SIEM for retention and analysis
Enable network intrusion detection on IT/OT boundaries to flag unauthorized management traffic reaching HMIs
Track the operational availability of each HMI as a first-class metric alongside process telemetry

How to Mitigate CVE-2024-21914

Immediate Actions Required

Apply the fixed FactoryTalk View firmware version identified in Rockwell Automation Security Advisory SD1663
Restrict network access to PanelView Plus 7 terminals to authorized engineering workstations only
Verify network segmentation between enterprise IT networks and OT control networks

Patch Information

Rockwell Automation has published remediation guidance in Security Advisory SD1663. Asset owners should consult the advisory for the fixed firmware versions applicable to their specific PanelView Plus 7 hardware and FactoryTalk View Machine Edition build, and schedule updates during planned maintenance windows.

Workarounds

Place PanelView Plus 7 terminals behind a firewall that limits inbound connections to trusted engineering hosts
Disable or block network protocols on the terminal that are not required for daily operations
Follow ISA/IEC 62443 zone-and-conduit segmentation to isolate HMIs from broader corporate traffic
Enforce jump-host access for any remote maintenance sessions to FactoryTalk View systems

bash

# Example: restrict inbound access to PanelView Plus 7 HMI at the network boundary
# Replace HMI_IP and ENG_WORKSTATION_SUBNET with values for your environment
iptables -A FORWARD -s ENG_WORKSTATION_SUBNET -d HMI_IP -j ACCEPT
iptables -A FORWARD -d HMI_IP -j DROP