CVE-2024-45824: FactoryTalk View RCE Vulnerability

CVE-2024-45824 Overview

A critical remote code execution vulnerability exists in Rockwell Automation FactoryTalk View SE. This vulnerability occurs when chained with Path Traversal, Command Injection, and Cross-Site Scripting (XSS) vulnerabilities, allowing for full unauthenticated remote code execution against affected industrial control systems.

Critical Impact

Unauthenticated attackers can achieve complete remote code execution on affected FactoryTalk View SE installations through a chained exploitation technique combining multiple vulnerability classes.

Affected Products

• Rockwell Automation FactoryTalk View SE (all vulnerable versions)

Discovery Timeline

• September 12, 2024 - CVE-2024-45824 published to NVD
• January 31, 2025 - Last updated in NVD database

Technical Details for CVE-2024-45824

Vulnerability Analysis

This vulnerability represents a severe security flaw in Rockwell Automation's FactoryTalk View SE, a widely deployed Human-Machine Interface (HMI) software used in industrial control system (ICS) environments. The vulnerability is classified under CWE-77 (Command Injection), indicating that the application improperly constructs commands using externally-influenced input, allowing attackers to inject and execute arbitrary commands.

What makes this vulnerability particularly dangerous is its chained nature—it combines multiple vulnerability types (Path Traversal, Command Injection, and XSS) to achieve full unauthenticated remote code execution. This multi-stage attack chain allows threat actors to bypass authentication mechanisms entirely and gain complete control over the affected system.

In industrial environments, FactoryTalk View SE serves as a critical interface between operators and industrial processes. Successful exploitation could allow attackers to manipulate industrial processes, access sensitive operational data, or pivot to other systems within the OT network.

Root Cause

The root cause stems from improper validation and sanitization of user-supplied input that is subsequently used in command construction. The application fails to adequately neutralize special characters and command sequences before they are processed, enabling command injection attacks. Combined with path traversal weaknesses and XSS vulnerabilities, attackers can construct a complete attack chain that bypasses normal security controls.

Attack Vector

The attack is network-accessible and requires no prior authentication or user interaction to exploit. An attacker can remotely target exposed FactoryTalk View SE instances over the network. The exploitation chain involves:

1. Leveraging path traversal vulnerabilities to access restricted file system locations
2. Exploiting command injection flaws to execute arbitrary system commands
3. Utilizing XSS vulnerabilities as part of the attack chain to further compromise the system

The network-based attack vector with no authentication requirements makes this vulnerability particularly concerning for internet-facing or inadequately segmented industrial environments.

Detection Methods for CVE-2024-45824

Indicators of Compromise

• Unusual network traffic patterns targeting FactoryTalk View SE web interfaces
• Unexpected process execution originating from FactoryTalk View SE application processes
• File system access attempts to directories outside normal application paths
• Suspicious command-line activity associated with the FactoryTalk View SE service account

Detection Strategies

• Monitor FactoryTalk View SE web server logs for path traversal patterns such as ../ sequences in HTTP requests
• Implement network intrusion detection rules to identify command injection payloads targeting the application
• Deploy endpoint detection and response (EDR) solutions to detect anomalous process behavior on HMI servers
• Review Windows Security Event logs for unusual process creation events from FactoryTalk-related services

Monitoring Recommendations

• Enable detailed logging for FactoryTalk View SE components and forward logs to a centralized SIEM
• Implement network segmentation monitoring to detect lateral movement attempts from compromised HMI systems
• Configure alerting for any outbound connections from FactoryTalk View SE servers to unexpected destinations
• Establish baseline behavior profiles for FactoryTalk View SE to identify deviations indicative of exploitation

How to Mitigate CVE-2024-45824

Immediate Actions Required

• Apply the security patches provided by Rockwell Automation immediately per the official security advisory
• Isolate FactoryTalk View SE systems from untrusted networks until patches can be applied
• Implement strict network segmentation between IT and OT environments
• Review and restrict network access to FactoryTalk View SE web interfaces to authorized personnel only

Patch Information

Rockwell Automation has released security patches to address this vulnerability. Administrators should consult the Rockwell Automation Security Advisory SD1696 for specific patch details, affected version information, and upgrade instructions. Organizations should prioritize patching given the critical severity and unauthenticated exploitation potential.

Workarounds

• Deploy web application firewalls (WAF) configured to detect and block path traversal and command injection attempts
• Implement network-level access controls to restrict connectivity to FactoryTalk View SE to only authorized IP ranges
• Disable unnecessary web-based features of FactoryTalk View SE until patches are applied
• Enable additional authentication mechanisms at the network level (VPN, jump servers) for accessing HMI systems

# Example: Network firewall rule to restrict access to FactoryTalk View SE
# Adjust IP ranges according to your environment
iptables -A INPUT -p tcp --dport 80 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP