PT-2022-10162 · Rockwell Automation · Factorytalk Services Platform

Published 2021-06-10 · Updated 2022-04-12 · CVE-2021-32960

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk Services Platform versions prior to 6.12

Description The issue allows a remote, authenticated attacker to bypass FactoryTalk Security policies based on the computer name. If successfully exploited, this may allow an attacker to have the same privileges as if they were logged on to the client machine.

Recommendations For Rockwell Automation FactoryTalk Services Platform versions prior to 6.12, update to a version later than 6.11 to resolve the issue. As a temporary workaround, consider restricting access to the system to minimize the risk of exploitation.

Fix

Protection Mechanism Failure

Incorrect Authorization

Weakness Enumeration

CWE-693

CWE-863

Related Identifiers

BDU:2025-05659

CVE-2021-32960

Affected Products

Factorytalk Services Platform

References · 9

• https://bdu.fstec.ru/vul/2025-05659 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-32960 · Security Note
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131785 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32960 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-21-161-01 · Note
• https://rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1569.html · Note
• https://cisa.gov/news-events/ics-advisories/icsa-21-161-01 · Note
• https://support.rockwellautomation.com/app/answers/answer_view/a_id/1131785 · Note
• https://t.me/cibsecurity/40060 · Telegram Post