The vulnerabilities are exploitable by sending specially crafted packets to the server, which can result in a DoS attack, according to an ICS-CERT advisory.
According to a company brochure, the FactoryTalk product extends the Rockwell Automation Integrated Architecture by providing an information tier of software applications and services for production and performance management. Integration with the Rockwell Automation Logix control platform, as well as connectivity to third-party and legacy systems enables FactoryTalk to deliver high-fidelity data flow across the enterprise.
ICS-CERT said it notified Rockwell Automation about the vulnerabilities, which were disclosed by Auriemma without coordination with ICS-CERT or the vendor.
As it has in past advisories, ICS-CERT recommends that users take the following defensive measures to minimize the risk of exploitation of these vulnerabilities: minimize network exposure for all control system device; locate control system networks and devices behind firewalls and isolate them from the business network; and if remote access is required, employ secure methods, such as virtual private networks.