Rockwell Automation FactoryTalk AssetCentre Encryption Vulnerability Allowing Password Extraction

A vulnerability exists in all versions of Rockwell Automation FactoryTalk AssetCentre prior to V15.00.001, due to a weak encryption methodology. This encryption vulnerability could allow a threat actor to extract passwords of other users within the application.

Impact

Exploitation of this vulnerability could lead to unauthorized access to user accounts by allowing the extraction of passwords from the application's database.

Remediation

Users are advised to update FactoryTalk AssetCentre to V15.00.01 or later. Additionally, control access to the database to prevent non-essential users from accessing encrypted data.