CVE-2024-37368 Overview
CVE-2024-37368 is an authentication vulnerability in Rockwell Automation FactoryTalk® View SE. The flaw allows a remote user with FTView installed to send a crafted packet to a customer's server and view a Human-Machine Interface (HMI) project. The server processes the request without verifying the requester's identity, exposing operational technology (OT) project content to unauthorized parties.
The weakness maps to [CWE-287] Improper Authentication and [CWE-306] Missing Authentication for Critical Function. FactoryTalk View SE is widely deployed in industrial control system (ICS) environments, making confidentiality of HMI project data important to plant safety and intellectual property.
Critical Impact
Remote, unauthenticated users on the network can retrieve HMI project content from FactoryTalk View SE servers, exposing process logic and plant operational details.
Affected Products
- Rockwell Automation FactoryTalk View SE
- Deployments exposing FTView services to remote network access
- ICS/OT environments running unpatched FactoryTalk View SE installations
Discovery Timeline
- 2024-06-14 - CVE-2024-37368 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-37368
Vulnerability Analysis
The vulnerability resides in the network-facing service of FactoryTalk View SE that handles HMI project access requests. A remote host running the FTView client can submit a packet that the server accepts and processes without confirming the caller's authenticated identity. The server returns HMI project data in response, treating the request as legitimate.
This design gap falls under both [CWE-287] and [CWE-306], indicating that an authentication check exists conceptually but is not enforced on this code path. The exploit requires network reach to the FactoryTalk View SE server and no user interaction on the target. The impact is limited to confidentiality of HMI project data based on the CVSS vector, with no direct integrity or availability impact reported by the vendor.
HMI projects often contain process logic, tag definitions, screen layouts, and references to programmable logic controllers (PLCs). Disclosure of these artifacts gives an attacker reconnaissance material to plan deeper intrusions into the OT environment.
Root Cause
The root cause is missing authentication verification on the request handler that serves HMI project content. The server trusts the requester based on protocol-level cues rather than validating credentials or session state. Any host that can reach the service and speak the FTView protocol can issue the request.
Attack Vector
The attack vector is network-based. An attacker needs reachability to the FactoryTalk View SE server over the network and a client capable of issuing the FTView protocol request. No credentials and no user interaction are required. The exploit can be executed from any remote system on the same routable network segment as the server, including jump hosts in flat ICS networks. Refer to the Rockwell Automation Security Advisory SD1676 for vendor-specific technical detail.
Detection Methods for CVE-2024-37368
Indicators of Compromise
- Unexpected FTView protocol connections to FactoryTalk View SE servers from hosts outside the engineering workstation inventory
- HMI project read requests originating from IP addresses not on the OT allow-list
- Outbound transfer of HMI project files or large project responses to unusual destinations
Detection Strategies
- Monitor FactoryTalk View SE server logs for project-access events lacking a corresponding authenticated session
- Baseline normal FTView client populations and alert on new client IPs initiating project queries
- Inspect ICS network traffic for FTView protocol flows that cross trust boundaries between business and OT networks
Monitoring Recommendations
- Forward FactoryTalk View SE application logs and host telemetry to a centralized SIEM for correlation with network flow data
- Apply network intrusion detection signatures on segments adjacent to FactoryTalk View SE servers to flag unauthenticated project requests
- Track authentication failures and anomalous session activity on engineering workstations that hold FTView credentials
How to Mitigate CVE-2024-37368
Immediate Actions Required
- Apply the fixed FactoryTalk View SE version published in Rockwell Automation advisory SD1676 to all affected servers
- Restrict network access to FactoryTalk View SE servers so that only authorized engineering workstations can reach the FTView service ports
- Audit existing FTView client installations and remove any that are not required for current operations
- Review HMI project access logs for unauthorized reads since the affected version was deployed
Patch Information
Rockwell Automation has published guidance and fixed releases in Security Advisory SD1676. Operators should consult the advisory for the specific FactoryTalk View SE versions that contain the authentication fix and follow vendor instructions for upgrade and validation.
Workarounds
- Place FactoryTalk View SE servers inside a segmented OT zone protected by a firewall that blocks FTView protocol traffic from untrusted networks
- Enforce host-based firewall rules on FactoryTalk View SE servers that allow inbound connections only from a defined list of engineering workstation IP addresses
- Disable or shut down FactoryTalk View SE services on systems that do not require remote HMI project access until patches are applied
- Monitor and alert on any cross-zone FTView traffic using ICS-aware network detection tools
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
