Lucene search

IcscertCVELIST:CVE-2021-27470

HistoryMar 23, 2022 - 7:46 p.m.

CVE-2021-27470 Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

2022-03-2319:46:35

CWE-502

icscert

www.cve.org

cve-2021-27470

rockwell automation

factorytalk assetcentre

deserialization vulnerability.

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

AI Score

9.9

Confidence

High

EPSS

0.005

Percentile

76.8%

JSON

A deserialization vulnerability exists in how the LogService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.

CNA Affected

[
  {
    "product": "FactoryTalk AssetCentre",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "lessThanOrEqual": "v10.00",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831

www.cisa.gov/uscert/ics/advisories/icsa-21-091-01

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

AI Score

9.9

Confidence

High

EPSS

0.005

Percentile

76.8%

JSON

Related for CVELIST:CVE-2021-27470