Executive Summary

The vulnerability in Verve Asset Manager allows unauthorized users who only have read-only access to the API to perform unauthorized actions such as reading, updating, and deleting user accounts. This is due to incorrect authorization controls in the software versions 1.33 through 1.42. The issue was discovered internally and is classified as a high-severity security flaw. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access and manipulation of user accounts within Verve Asset Manager. An attacker with read-only API access could read sensitive user information, modify user details, or delete user accounts, potentially disrupting operations and compromising security in industrial control systems. [1]

Useful 0 Not Useful 0

Detection Guidance

There are no specific detection commands or network indicators provided for this vulnerability. Detection would likely involve verifying the version of Verve Asset Manager in use (versions 1.33 through 1.42 are affected) and checking for unauthorized API activity related to user account read, update, or deletion actions. Since the vulnerability allows unauthorized API access, monitoring API logs for suspicious user management operations by read-only users may help detect exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Verve Asset Manager to version 1.42 or later, where the vulnerability is fixed. If upgrading is not immediately possible, it is recommended to follow security best practices such as removing any read-only user accounts to reduce risk. Additionally, monitoring and restricting API access and subscribing to Rockwell Automation security alerts for updates are advised. [1]

Useful 0 Not Useful 0