CVE-2024-21914 Rockwell Automation - FactoryTalk® View ME on PanelView™ Plus 7 Boot Terminal lack Security Protections

What is CVE-2024-21914?

CVE-2024-21914 is a medium-severity denial of service vulnerability in Rockwell Automation FactoryTalk® View ME, published on 25 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability exists in the affected product that allows a malicious user to restart the Rockwell Automation PanelView™ Plus 7 terminal remotely without security protections. If the vulnerability is exploited, it could lead to the loss of view or control of the PanelView™ product.

Weakness: CWE-400

Which versions are affected by CVE-2024-21914?

It affects 1 product.

Products include Rockwellautomation Factorytalk View.

How do I fix CVE-2024-21914?

No fix has been published for CVE-2024-21914 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-21914 being exploited?

There is no known exploitation of CVE-2024-21914 in the wild and no public exploit code.

Other vulnerabilities in Rockwell Automation FactoryTalk® View ME

• CVE-2023-2071 FactoryTalk View Machine Edition Vulnerable to Remote Code Execution Critical 9.8
• CVE-2024-45824 FactoryTalk® View Site Edition Remote Code Execution Vulnerability via Lack of Input Validation Critical 9.2
• CVE-2020-12029 Rockwell Automation FactoryTalk View SE Critical 9.0
• CVE-2024-4609 Rockwell Automation Datalog Function within in FactoryTalk® View SE contains SQL Injection Vulnerability High 8.8
• CVE-2025-9064 Rockwell Automation FactoryTalk View Machine Edition Path Traversal High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-925f-cxg2-4483.