A
vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service token and directory. If exploited, a malicious user could potentially retrieve user information and modify settings without any authentication.
References
Configurations
History
15 Jan 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | (en) A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service token and directory. If exploited, a malicious user could potentially retrieve user information and modify settings without any authentication. |
21 Nov 2024, 08:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.rockwellautomation.com/en-us/support/advisory.SD1660.html - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
Information
Published : 2024-01-31 19:15
Updated : 2026-01-15 16:16
NVD link : CVE-2024-21917
Mitre link : CVE-2024-21917
CVE.ORG link : CVE-2024-21917
JSON object : View
Products Affected
CWE
CWE-347
Improper Verification of Cryptographic Signature