Successful exploitation of this vulnerability could allow an attacker to impersonate an authorized user on the FTSP server, resulting in unauthorized access to system configurations.
The following versions of Rockwell Automation FactoryTalk Services Platform are affected:
FactoryTalk Directory (FTSP) 6.60
Vendor
Equipment
Rockwell Automation
Rockwell Automation FactoryTalk Services Platform
Weak Authentication
Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: United States
A security issue exists within FactoryTalk Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication. The vulnerability stems from the application not verifying that the JWT algorithm is configured for RSA, enabling an attacker to set the algorithm to "none" and craft forged tok...
Read the full advisory on CISA →