CVE-2024-21915: FactoryTalk Services Privilege Escalation

CVE-2024-21915 Overview

CVE-2024-21915 is a privilege escalation vulnerability affecting Rockwell Automation FactoryTalk® Service Platform (FTSP). An authenticated user with basic user group privileges can sign into the software and receive FTSP Administrator Group privileges. The vulnerability maps to [CWE-732] Incorrect Permission Assignment for Critical Resource.

A successful attacker can read and modify sensitive data, delete data, and render the FTSP system unavailable. Because FactoryTalk Service Platform underpins operational technology (OT) environments across manufacturing and industrial control systems, the flaw carries elevated operational risk.

Critical Impact
An authenticated low-privilege user can obtain FTSP Administrator Group privileges, gaining full read, write, and delete access across the FactoryTalk Service Platform.

Affected Products

Rockwell Automation FactoryTalk Services Platform
Deployments integrated with FactoryTalk-based industrial control system (ICS) applications
Environments using FTSP for centralized authentication and authorization

Discovery Timeline

2024-02-16 - CVE-2024-21915 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21915

Vulnerability Analysis

The vulnerability resides in how FactoryTalk Service Platform assigns group membership and permissions during authentication. A user account provisioned only with basic user group privileges is granted FTSP Administrator Group privileges after signing in. This effectively collapses the platform's role-based access control model.

Once elevated, the attacker inherits administrative control over the FTSP directory, security accounts, and application services that rely on FTSP for authorization decisions. Downstream FactoryTalk products that trust FTSP identities also inherit the escalated privileges.

Root Cause

The root cause is an incorrect permission assignment for a critical resource, tracked as [CWE-732]. FTSP does not correctly enforce the boundary between the basic user group and the administrator group during session establishment. The privilege check that should restrict group membership is either missing or evaluated incorrectly, allowing unauthorized privilege inheritance.

Attack Vector

The attack requires network access to the FactoryTalk Service Platform and valid credentials for any account in the basic user group. The attacker authenticates through the standard FTSP sign-in flow. On successful authentication, the session receives Administrator Group privileges without any additional exploitation primitive, user interaction, or elevated complexity.

No public proof-of-concept code is available for this vulnerability. Rockwell Automation has published technical details in Rockwell Automation Security Advisory SD1662.

Detection Methods for CVE-2024-21915

Indicators of Compromise

Authentication events where basic user accounts subsequently perform administrator-only actions in FTSP audit logs.
Unexpected changes to FTSP security accounts, group membership, or policy configuration originating from non-administrator users.
Deletion or modification of FactoryTalk directory objects and project data by accounts not previously assigned administrative rights.

Detection Strategies

Correlate FTSP authentication logs with subsequent administrative actions to identify privilege inheritance anomalies.
Baseline expected administrator accounts and alert on any new account exercising administrator-level operations.
Review FactoryTalk Diagnostics logs for security policy changes performed by low-privilege users.

Monitoring Recommendations

Forward FTSP and FactoryTalk Diagnostics logs to a centralized SIEM or data lake for correlation with endpoint and network telemetry.
Monitor network access to FTSP servers from workstations that do not belong to administrator personnel.
Track configuration and directory changes on FTSP servers using file integrity monitoring.

How to Mitigate CVE-2024-21915

Immediate Actions Required

Apply the patched version of FactoryTalk Service Platform as directed in Rockwell Automation Security Advisory SD1662.
Audit all FTSP user accounts and group memberships and remove unnecessary or dormant accounts.
Rotate credentials for accounts that may have signed in during the exposure window.

Patch Information

Rockwell Automation has released a security patch addressing CVE-2024-21915. Refer to Rockwell Automation Security Advisory SD1662 for supported fixed versions, download links, and upgrade guidance specific to your FTSP deployment.

Workarounds

Restrict network access to FTSP servers to trusted engineering workstations using firewall rules or network segmentation.
Enforce the principle of least privilege by limiting the number of accounts that can authenticate to FTSP.
Follow Rockwell Automation ICS security hardening guidance, including isolating OT networks from corporate IT networks.

bash

# Example: restrict inbound access to FTSP server to engineering subnet only
# Windows Firewall rule (run on the FTSP host)
netsh advfirewall firewall add rule name="FTSP-Allow-Engineering" \
  dir=in action=allow protocol=TCP localport=any \
  remoteip=10.10.20.0/24

netsh advfirewall firewall add rule name="FTSP-Block-All" \
  dir=in action=block protocol=TCP localport=any \
  remoteip=any