CVE-2024-7956

CVE-2024-7956 is an improper authentication flaw (CWE-287) in Rockwell Automation's FactoryTalk Optix in which user-to-project access is not correctly enforced, letting a threat actor reach other users' projects. It is triggered remotely over the network (AV:N) by an attacker who already holds basic, low-privilege user credentials, with no user interaction required. If exploited, the attacker can view, modify, and delete projects they should not be able to access, producing high confidentiality and integrity impact on the affected system but no availability loss and no impact on other systems. Affected are organizations running the affected Rockwell Automation products, particularly multi-user deployments where basic users connect to shared projects over the network. There is no known exploitation in the wild, no public proof-of-concept, and no entry in CISA KEV (EPSS ~0.3%).

What to do: Upgrade FactoryTalk Optix to the patched release identified in Rockwell Automation's security advisory (specific version numbers are not provided in the source data). Until patched, restrict network access to affected instances, limit which basic-privilege accounts can connect, and review project audit logs for unexpected modifications or deletions performed by low-privilege users.