Read the docs
TI-2023-02466 Aliases CVE-2023-2637GHSA-v84g-528v-42pp

Rockwell Automation FactoryTalk System Services Vulnerable To Use Of Hard-Coded Cryptographic Key

Priority LOW 37CWE-321Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-321.

Summary

Rockwell Automation's FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies.  Hard-coded cryptographic key may lead to privilege escalation.  This vulnerability may allow a local, authenticated non-admin user to generate an invalid administrator cookie giving them administrative privileges to the FactoryTalk Policy Manger database. This may allow the threat actor to make malicious changes to the database that will be deployed when a legitimate FactoryTalk Policy Manager user deploys a security policy model. User interaction is required for this vulnerability to be successfully exploited.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00203 10th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RockwellFactoryTalk System Servicesup to 6.20—No fix listedCNA
  • FactoryTalk System Services VendorRockwell Affected up to 6.20 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:rockwellautomation:factorytalk_policy_manager:6.11.0:*:*:*:*:*:*:*6.11.0VulnerableRockwell
cpe:2.3:a:rockwellautomation:factorytalk_system_services:6.11.0:*:*:*:*:*:*:*6.11.0VulnerableRockwell
  • cpe:2.3:a:rockwellautomation:factorytalk_policy_manager:6.11.0:*:*:*:*:*:*:* Versions 6.11.0 Vulnerable ·Rockwell
  • cpe:2.3:a:rockwellautomation:factorytalk_system_services:6.11.0:*:*:*:*:*:*:* Versions 6.11.0 Vulnerable ·Rockwell

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-2637
  2. 2026-10-03 Alias added: GHSA-v84g-528v-42pp

References

Advisory 1

  • TI-2024-05869 Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services CVSS 4.0MEDIUM 6.0
  • TI-2023-02467 Rockwell Automation FactoryTalk System Services Vulnerable to a Denial-of-Service Attack CVSS 3.1MEDIUM 5.9
  • TI-2023-02468 Rockwell Automation FactoryTalk System Services Vulnerable to Sensitive Information Disclosure CVSS 3.1MEDIUM 4.7
  • TI-2024-05870 Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services CVSS 4.0LOW 1.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences