Lucene search

IcscertCVELIST:CVE-2021-27464

HistoryMar 23, 2022 - 7:46 p.m.

CVE-2021-27464 Rockwell Automation FactoryTalk AssetCentre SQL Injection

2022-03-2319:46:30

CWE-89

icscert

www.cve.org

cve-2021-27464

rockwell automation

factorytalk assetcentre

sql injection

archiveservice.rem

remote attacker

unauthenticated

sql statements

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

AI Score

9.9

Confidence

High

EPSS

0.002

Percentile

54.7%

JSON

The ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.

CNA Affected

[
  {
    "product": "FactoryTalk AssetCentre",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "lessThanOrEqual": "v10.00",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831

www.cisa.gov/uscert/ics/advisories/icsa-21-091-01

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

AI Score

9.9

Confidence

High

EPSS

0.002

Percentile

54.7%

JSON

Related for CVELIST:CVE-2021-27464