Lucene search

K
cvelistIcscertCVELIST:CVE-2021-27462
HistoryMar 23, 2022 - 7:46 p.m.

CVE-2021-27462 Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

2022-03-2319:46:30
CWE-502
icscert
www.cve.org
6
cve-2021-27462
aosservice.rem
factorytalk assetcentre
untrusted data
remote execution

CVSS3

10

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

AI Score

9.9

Confidence

High

EPSS

0.005

Percentile

76.8%

A deserialization vulnerability exists in how the AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.

CNA Affected

[
  {
    "product": "FactoryTalk AssetCentre",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "lessThanOrEqual": "v10.00",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

CVSS3

10

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

AI Score

9.9

Confidence

High

EPSS

0.005

Percentile

76.8%

Related for CVELIST:CVE-2021-27462