PN1541 | FactoryTalk AssetCentre affected by M and M Software fdtCONTAINER Remote Code Execution Vulnerability

Executive Summary

Affected Products

Vulnerability Details

Risk Mitigation & User Action

1. Open FactoryTalk Admin Console
2. Select “System”
3. Select “Policies”
4. Select “FactoryTalk AssetCentre”
5. Open “Feature Security Properties”
6. Locate “Run PDC Field Edition” under “Process Device Configuration Policies” and select the ellipses (…) next to “Configure Security”.
7. Select the “Deny” Checkboxes for “Administrators” and “All Users”
8. Select “OK”
9. Select “Apply”

General Security Guidelines

• Utilize proper network infrastructure controls, such as firewalls, to help ensure that traffic from unauthorized sources are blocked.
• Block all traffic to EtherNet/IP^™ or other CIP^™ protocol-based devices from outside the Manufacturing Zone by blocking or restricting access to TCP and UDP Port# 2222 and Port# 44818 using proper network infrastructure controls, such as firewalls, UTM devices or other security appliances. For more information on TCP/UDP ports used by Rockwell Automation Products, see Knowledgebase Article ID 898270.

• Do not use standalone PDC Field Edition
• Run all software as User, not as an Administrator, to minimize the impact of malicious code on the infected system.
• Use Microsoft^® AppLocker or another similar allow list application to help mitigate risk. Information on using AppLocker with Rockwell Automation products is available at Knowledgebase Article ID 546989.
• Confirm that the least-privilege user principle is followed and user/service account access to shared resources (such as a database) is only granted with a minimum amount of rights as needed.

• Do not open untrusted files with FactoryTalk AssetCentre.
• Do not click or open URL links from untrusted sources.
• Employ training and awareness programs to educate users on the warning signs of a phishing or social engineering attack.

• Use trusted software, software patches, antivirus/antimalware programs and interact only with trusted websites and attachments.
• Minimize network exposure for all control system devices and/or systems and confirm that they are not accessible from the Internet. For further information about the risks of unprotected Internet accessible control systems, please see Knowledgebase Article ID 494865
• Locate control system networks and devices behind firewalls and isolate them from the business network.
• When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that a VPN is only as secure as the connected devices.

• 54102 - Industrial Security Advisory Index
• Industrial Firewalls within a CPwE Architecture
• Deploying Industrial Firewalls within a CPwE Architecture Design and Implementation Guide