CVE-2024-21917

A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service token and directory.  If exploited, a malicious user could potentially retrieve user information and modify settings without any authentication.

• CWE-347
• CWE-347

• https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1660.html
• https://www.rockwellautomation.com/en-us/support/advisory.SD1660.htmlVendor Advisory

Published

Jan 31, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21911TinyMCE versions before 5.6.0 are affected by a stored cross…6.1
• CVE-2024-21912 An arbitrary code execution vulnerability in Rockwell Autom…7.8
• CVE-2024-21913 A heap-based memory buffer overflow vulnerability in Rockwe…7.8
• CVE-2024-21914 A vulnerability exists in the affected product that allows …5.3
• CVE-2024-21915 A privilege escalation vulnerability exists in Rockwell Aut…8.8
• CVE-2024-21916 A denial-of-service vulnerability exists in specific Rockwe…7.5
• CVE-2024-21918 A memory buffer vulnerability in Rockwell Automation Arena …7.8
• CVE-2024-21919 An uninitialized pointer in Rockwell Automation Arena Simul…7.8
• CVE-2024-21920 A memory buffer vulnerability in Rockwell Automation Aren…7.1
• CVE-2024-21922A DLL hijacking vulnerability in AMD StoreMI™ could allow an…7.3
• CVE-2024-21923Incorrect default permissions in AMD StoreMI™ could allow an…7.3
• CVE-2024-21924SMM callout vulnerability within the AmdPlatformRasSspSmm dr…8.2