Horizon Alert
Summary of the vulnerability and why it matters
This advisory details an authentication bypass vulnerability in FactoryTalk Historian Site Edition, where continuous requests to the login endpoint can grant an attacker a valid authentication token. The main concern is confirming relevance and exposure, as this industrial operations software is typically isolated within internal networks.
- Bypass login to gain access.
- Confirm if this affects our systems.
- Understand potential operational impact.
Attack Path
How an attacker could exploit the issue
An attacker could bypass authentication by repeatedly sending requests to the login endpoint of FactoryTalk Historian Site Edition. This would allow them to obtain a valid authentication token, potentially leading to unauthorized access and control within the system.
- Requires network access.
- Continually sending login requests.
- Unauthorized access to system.
Live Threat
Current exploitation, exposure, and threat context
An attacker who can send repeated requests to the login endpoint of FactoryTalk Historian Site Edition could potentially obtain a valid authentication token. This could affect access to the system's historical data and operational information.
- Access to system data.
- Repeated requests to the login endpoint.
- Unauthorized access to historical data.
Operational Fix
Recommended remediation, mitigation, and detection steps
The vulnerability in FactoryTalk Historian Site Edition likely impacts operational technology (OT) teams and potentially IT security teams responsible for securing industrial control systems. The first practical step is to identify all instances of FactoryTalk Historian Site Edition within the environment, confirm their network exposure and business criticality, and then ascertain the accountable owner before planning remediation.
- OT and Security teams own this issue.
- Verify network reachability and business criticality.
- Plan coordinated remediation based on risk.
