Vulnerability · Published Mar 18, 2021 · Assigned by icscert
CVE-2021-22665
High 7.8
In plain English
A high-severity uncontrolled search path in Rockwell Automation DriveTools SP and Drives AOP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.4%top 60.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Rockwell Automation DriveTools SP v5.13 and below and Drives AOP v4.12 and below both contain a vulnerability that a local attacker with limited privileges may be able to exploit resulting in privilege escalation and complete control of the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Rockwell Automation DriveTools SP and Drives AOP | DriveTools SP v5.13 and below and Drives AOP v4.12 and below |
Weakness: CWE-427
References
- https://us-cert.cisa.gov/ics/advisories/icsa-21-042-02 x_refsource_MISC
- https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1129798 x_refsource_MISC