CVE-2024-21915
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedA privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform (FTSP). If exploited, a malicious user with basic user group privileges could potentially sign into the software and receive FTSP Administrator Group privileges. A threat actor could potentially read and modify sensitive data, delete data and render the FTSP system unavailable.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceThis is a privilege escalation vulnerability in Rockwell Automation FactoryTalk Service Platform (FTSP) where the application's authorization logic fails to properly enforce group membership boundaries. A user belonging to basic user groups can bypass intended access controls and acquire FTSP Administrator Group privileges, enabling full administrative access to read/modify sensitive data, delete information, and cause denial of service.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 2.74CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed FTSP versionCheck the installed version of FactoryTalk Services Platform in Windows Programs and Features (appwiz.cpl) or query the installed software via registry or vendor tools. Look for 'Rockwell Automation FactoryTalk Services Platform' or similar entry.Affected if The displayed version is lower than 2.74 (e.g., 2.70, 2.72, etc.) or no version is shown (unpatched installation).
-
Verify FTSP services are runningOpen Services console (services.msc) and look for FactoryTalk-related services such as 'FactoryTalk Gateway', 'FactoryTalk Directory', or 'FactoryTalk Services Platform' services. Check their status.Affected if Any FTSP services are running on a version identified as vulnerable in step 1.
-
Review user group memberships in FTSPAccess the FTSP administration console or use FactoryTalk Administration Console to view all users assigned to the 'FTSP Administrators' or 'Administrators' group. Export or document the list of users in elevated groups.Affected if Users who should only be in basic user groups (non-administrative) appear as members of administrative groups, indicating potential exploitation.
-
Audit recent user account changesReview FTSP audit logs, Windows Security event logs, or FactoryTalk audit trails for events related to group membership changes, especially additions to Administrator groups, performed within the timeframe of vulnerability exposure.Affected if Group membership changes exist that added basic users to Administrator groups without documented approval, suggesting unauthorized privilege escalation.
-
Check for unauthorized admin accountsUsing the FTSP administrative console, enumerate all accounts with Administrator-level privileges and cross-reference against the expected list of authorized administrators from documentation or change management records.Affected if Administrator accounts exist that are not documented or approved, indicating possible exploitation of the privilege escalation flaw.
You are affected if FactoryTalk Services Platform is installed with a version lower than 2.74 and there are users in administrative groups who should only belong to basic user groups, or unexplained admin accounts are present.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped2.74
Apply the vendor-provided patch or update to FTSP that corrects the privilege escalation flaw. Verify that user group assignments are properly enforced after the update and audit existing admin accounts for unauthorized elevation.
FactoryTalk Services Platform 2.74
- 1. Back up all FactoryTalk Services Platform databases and configuration files before proceeding with the upgrade.
- 2. Verify that your current system meets the hardware and software prerequisites for FactoryTalk Services Platform version 2.74 or later.
- 3. Ensure all dependent FactoryTalk applications are compatible with version 2.74 before upgrading.
- 4. Download FactoryTalk Services Platform version 2.74 or later from the Rockwell Automation Product Compatibility and Download Center (PCDC).
- 5. Stop all FactoryTalk services on the server before running the upgrade installer.
- 6. Run the installer with Administrator privileges and follow the on-screen installation wizard prompts.
- 7. After installation completes, verify that all FactoryTalk services start successfully.
- 8. Test the privilege escalation fix by creating a basic user account and confirming it cannot escalate to Administrator group privileges.
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation8.0 h
- Implementation12.0 h
- Testing16.0 h
- Review / QA8.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $12,160.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2024-21915 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2024-21915 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data