High Threat

CVE-2023-2637

CWE 321: Use of Hard-Coded Cryptographic Keys
Hard-coded cryptographic key vulnerabilities could lead to privilege escalation. FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies. This vulnerability could allow a local authenticated non-admin user to generate an invalid administrator cookie giving them administrative privileges to the FactoryTalk Policy Manger database. The threat actor could make malicious changes to the database to be deployed when a legitimate FactoryTalk Policy Manager user deploys a security policy model. User interaction is required to successfully exploit this vulnerability.