Impact Analysis

An attacker on the intranet could exploit this vulnerability to access sensitive data stored in the Redis database and potentially modify it. This could lead to unauthorized disclosure of sensitive information and data integrity issues within the affected system. [1]

Useful 0 Not Useful 0

Executive Summary

This vulnerability is caused by an over-permissive Redis database instance embedded within the affected product, FactoryTalk® Analytics™ LogixAI® versions 3.00 and 3.01. Redis is configured in a way that allows unauthorized access from an attacker on the internal network (intranet). This misconfiguration can let the attacker access sensitive data stored in the Redis database and potentially alter that data. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of an over-permissive Redis instance embedded within the affected FactoryTalk® Analytics™ LogixAI® versions 3.00 or 3.01. You can attempt to connect to the Redis instance on the internal network to see if unauthorized access is possible. Common commands to test Redis access include using the redis-cli tool to connect and run commands like PING, INFO, or KEYS *. For example, running 'redis-cli -h <host> -p <port> PING' to check connectivity, or 'redis-cli -h <host> -p <port> KEYS *' to list keys if access is allowed without authentication. Detection involves verifying if Redis is accessible without proper authentication or with overly permissive permissions. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade FactoryTalk® Analytics™ LogixAI® to version 3.02 or later, where the issue is resolved. If upgrading immediately is not possible, follow Rockwell Automation's security best practices to limit access to the Redis instance, such as restricting network access to trusted hosts only and monitoring for unauthorized access attempts. There is no workaround provided other than upgrading. [1]

Useful 0 Not Useful 0