Rockwell Apache Vulnerability in FactoryTalk® Historian-ThingWorx Connection Server

An attacker with network access to the FactoryTalk Historian-ThingWorx Connection Server could execute arbitrary code on the server, potentially allowing them to read or modify production data, interfere with historian logging, or pivot to other systems on your network.

This affects any organization running FactoryTalk Historian with ThingWorx integration, commonly found in manufacturing facilities (auto, pharma, food/beverage), chemical plants, and utilities. The historian is critical for compliance reporting (21 CFR Part 11, NIST) and stores operational records essential for production auditing and root cause analysis.

The vulnerability is in Apache software embedded in the Connection Server. An attacker can send a crafted request to the affected service port (typically port 80 or 443) without authentication. Once the attacker gains code execution, they can run commands as the service account, which often has access to historian databases and network credentials.