CVE-2021-27476: Rockwell Automation FactoryTalk AssetCentre OS Command Injection
First published: Wed Mar 23 2022(Updated: )
A vulnerability exists in the SaveConfigFile function of the RACompare Service, which may allow for OS command injection. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rockwell Automation FactoryTalk AssetCentre | ||
| rockwellautomation FactoryTalk AssetCentre | <=10.00 |
Remedy
Rockwell Automation encourages users of the affected versions of FactoryTalk AssetCentre to update to AssetCentre v11 (or above) to addresses these vulnerabilities. For more information about these vulnerabilities and mitigations please see Rockwell Automation’s publication KnowledgeBase ID: PN1559
Remedy
As an additional mitigation, Rockwell Automation encourages users who are unable to upgrade or are concerned about unauthorized client connections to use built in security features found within FactoryTalk AssetCentre. Users should follow guidance found in QA46277. IPsec would minimize exposure to unauthorized clients and has been tested in FactoryTalk AssetCentre v9-v11
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-091-01
- https://www.cisa.gov/news-events/ics-advisories/icsa-21-091-01 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2021-27476?
CVE-2021-27476 has been rated as a high severity vulnerability due to the potential for OS command injection.
How do I fix CVE-2021-27476?
To mitigate CVE-2021-27476, users should upgrade to a version of Rockwell Automation FactoryTalk AssetCentre that is newer than v10.00.
Who is affected by CVE-2021-27476?
CVE-2021-27476 affects users of Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier.
What type of vulnerability is CVE-2021-27476?
CVE-2021-27476 is classified as an OS command injection vulnerability.
Can CVE-2021-27476 be exploited remotely?
Yes, CVE-2021-27476 can be exploited by remote, unauthenticated attackers.
- agent/weakness
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/title
- agent/references
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- vendor/rockwell automation
- canonical/rockwell automation factorytalk assetcentre
- vendor/rockwellautomation
- canonical/rockwellautomation factorytalk assetcentre
- version/rockwellautomation factorytalk assetcentre/10.00