Vulnerabilidades do Rockwell Automation Factorytalk Services Platform

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Rockwell Automation Factorytalk Services Platform: 2 registro(s), com versões afetadas e correções.
cpe:2.3:a:rockwellautomation:factorytalk_services_platform

CVE-2026-10714 Alta · 8.8 CWE-1390 14/07/2026

Rockwell Automation FactoryTalk® Services Platform FTSP - Weak Authentication via JWT Validation Bypass

A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication. The vulnerability stems from the application not verifying that the JWT algorithm is configured for RSA, enabling an attacker to set the algorithm to "none" and craft forged tokens. This could allow an authenticated low-privilege user to impersonate any authorized user on the FTSP server, resulting in unauthorized access to system configuration and the ability to grant permissions to other systems protected by FTSP.

CVE-2021-22681 Crítica · 9.8 KEV Alta · 69 Exploit público CWE-522 03/03/2021

Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.