Where
-Infinity
0

Trending

Last week
Last month
Last year

Versions

10.00
9

Rockwell Automation FactoryTalk AssetCentre, v10.00 and earlierRockwell Automation FactoryTalk AssetCentre OS Command Injection

Risk 88
Severity
10
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability exists in the SaveConfigFile function of the RACompare Service, which may allow for OS command injection. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier.

Remedy

Rockwell Automation encourages users of the affected versions of FactoryTalk AssetCentre to update to AssetCentre v11 (or above) to addresses these vulnerabilities. For more information about these vulnerabilities and mitigations please see Rockwell Automation’s publication KnowledgeBase ID: PN1559

Remedy

As an additional mitigation, Rockwell Automation encourages users who are unable to upgrade or are concerned about unauthorized client connections to use built in security features found within FactoryTalk AssetCentre. Users should follow guidance found in QA46277. IPsec would minimize exposure to unauthorized clients and has been tested in FactoryTalk AssetCentre v9-v11
First published (updated )
CVE-2021-27476

Rockwell Automation FactoryTalk AssetCentre, v10.00 and earlierRockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

Risk 88
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A deserialization vulnerability exists in how the LogService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.

Remedy

Rockwell Automation encourages users of the affected versions of FactoryTalk AssetCentre to update to AssetCentre v11 (or above) to addresses these vulnerabilities. For more information about these vulnerabilities and mitigations please see Rockwell Automation’s publication KnowledgeBase ID: PN1559

Remedy

As an additional mitigation, Rockwell Automation encourages users who are unable to upgrade or are concerned about unauthorized client connections to use built in security features found within FactoryTalk AssetCentre. Users should follow guidance found in QA46277. IPsec would minimize exposure to unauthorized clients and has been tested in FactoryTalk AssetCentre v9-v11
First published (updated )
CVE-2021-27470

Rockwell Automation FactoryTalk AssetCentre, v10.00 and earlierRockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

Risk 88
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A deserialization vulnerability exists in how the ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.

Remedy

Rockwell Automation encourages users of the affected versions of FactoryTalk AssetCentre to update to AssetCentre v11 (or above) to addresses these vulnerabilities. For more information about these vulnerabilities and mitigations please see Rockwell Automation’s publication KnowledgeBase ID: PN1559

Remedy

As an additional mitigation, Rockwell Automation encourages users who are unable to upgrade or are concerned about unauthorized client connections to use built in security features found within FactoryTalk AssetCentre. Users should follow guidance found in QA46277. IPsec would minimize exposure to unauthorized clients and has been tested in FactoryTalk AssetCentre v9-v11
First published (updated )
CVE-2021-27466

Rockwell Automation FactoryTalk AssetCentre, v10.00 and earlierRockwell Automation FactoryTalk AssetCentre Use of Potentially Dangerous Function

Risk 88
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier does not properly restrict all functions relating to IIS remoting services. This vulnerability may allow a remote, unauthenticated attacker to modify sensitive data in FactoryTalk AssetCentre.

Remedy

Rockwell Automation encourages users of the affected versions of FactoryTalk AssetCentre to update to AssetCentre v11 (or above) to addresses these vulnerabilities. For more information about these vulnerabilities and mitigations please see Rockwell Automation’s publication KnowledgeBase ID: PN1559

Remedy

As an additional mitigation, Rockwell Automation encourages users who are unable to upgrade or are concerned about unauthorized client connections to use built in security features found within FactoryTalk AssetCentre. Users should follow guidance found in QA46277. IPsec would minimize exposure to unauthorized clients and has been tested in FactoryTalk AssetCentre v9-v11
First published (updated )
CVE-2021-27474

Rockwell Automation FactoryTalk AssetCentre, v10.00 and earlierRockwell Automation FactoryTalk AssetCentre SQL Injection

Risk 88
Severity
10
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.

Remedy

Rockwell Automation encourages users of the affected versions of FactoryTalk AssetCentre to update to AssetCentre v11 (or above) to addresses these vulnerabilities. For more information about these vulnerabilities and mitigations please see Rockwell Automation’s publication KnowledgeBase ID: PN1559

Remedy

As an additional mitigation, Rockwell Automation encourages users who are unable to upgrade or are concerned about unauthorized client connections to use built in security features found within FactoryTalk AssetCentre. Users should follow guidance found in QA46277. IPsec would minimize exposure to unauthorized clients and has been tested in FactoryTalk AssetCentre v9-v11
First published (updated )
CVE-2021-27468

Rockwell Automation FactoryTalk AssetCentre, v10.00 and earlierRockwell Automation FactoryTalk AssetCentre SQL Injection

Risk 88
Severity
10
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability exists in the RunSearch function of SearchService service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier, which may allow for the execution of remote unauthenticated arbitrary SQL statements.

Remedy

Rockwell Automation encourages users of the affected versions of FactoryTalk AssetCentre to update to AssetCentre v11 (or above) to addresses these vulnerabilities. For more information about these vulnerabilities and mitigations please see Rockwell Automation’s publication KnowledgeBase ID: PN1559

Remedy

As an additional mitigation, Rockwell Automation encourages users who are unable to upgrade or are concerned about unauthorized client connections to use built in security features found within FactoryTalk AssetCentre. Users should follow guidance found in QA46277. IPsec would minimize exposure to unauthorized clients and has been tested in FactoryTalk AssetCentre v9-v11
First published (updated )
CVE-2021-27472

Rockwell Automation FactoryTalk AssetCentre, v10.00 and earlierRockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

Risk 88
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A deserialization vulnerability exists in how the AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.

Remedy

Rockwell Automation encourages users of the affected versions of FactoryTalk AssetCentre to update to AssetCentre v11 (or above) to addresses these vulnerabilities. For more information about these vulnerabilities and mitigations please see Rockwell Automation’s publication KnowledgeBase ID: PN1559

Remedy

As an additional mitigation, Rockwell Automation encourages users who are unable to upgrade or are concerned about unauthorized client connections to use built in security features found within FactoryTalk AssetCentre. Users should follow guidance found in QA46277. IPsec would minimize exposure to unauthorized clients and has been tested in FactoryTalk AssetCentre v9-v11
First published (updated )
CVE-2021-27462

Rockwell Automation FactoryTalk AssetCentre, v10.00 and earlierRockwell Automation FactoryTalk AssetCentre SQL Injection

Risk 88
Severity
10
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.

Remedy

Rockwell Automation encourages users of the affected versions of FactoryTalk AssetCentre to update to AssetCentre v11 (or above) to addresses these vulnerabilities. For more information about these vulnerabilities and mitigations please see Rockwell Automation’s publication KnowledgeBase ID: PN1559

Remedy

As an additional mitigation, Rockwell Automation encourages users who are unable to upgrade or are concerned about unauthorized client connections to use built in security features found within FactoryTalk AssetCentre. Users should follow guidance found in QA46277. IPsec would minimize exposure to unauthorized clients and has been tested in FactoryTalk AssetCentre v9-v11
First published (updated )
CVE-2021-27464

Rockwell Automation FactoryTalk AssetCentre, v10.00 and earlierRockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

Risk 88
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier components contain .NET remoting endpoints that deserialize untrusted data without sufficiently verifying that the resulting data will be valid. This vulnerability may allow a remote, unauthenticated attacker to gain full access to the FactoryTalk AssetCentre main server and all agent machines.

Remedy

Rockwell Automation encourages users of the affected versions of FactoryTalk AssetCentre to update to AssetCentre v11 (or above) to addresses these vulnerabilities. For more information about these vulnerabilities and mitigations please see Rockwell Automation’s publication KnowledgeBase ID: PN1559

Remedy

As an additional mitigation, Rockwell Automation encourages users who are unable to upgrade or are concerned about unauthorized client connections to use built in security features found within FactoryTalk AssetCentre. Users should follow guidance found in QA46277. IPsec would minimize exposure to unauthorized clients and has been tested in FactoryTalk AssetCentre v9-v11
First published (updated )
CVE-2021-27460

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203