Vulnerability · Published Mar 23, 2022 · Assigned by icscert

CVE-2021-27460Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

Critical 10.0

In plain English

A critical-severity unsafe deserialization in FactoryTalk AssetCentre from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)3.2%top 11.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier components contain .NET remoting endpoints that deserialize untrusted data without sufficiently verifying that the resulting data will be valid. This vulnerability may allow a remote, unauthenticated attacker to gain full access to the FactoryTalk AssetCentre main server and all agent machines.

Affected products (as reported)

Vendor	Product	Versions
Rockwell Automation	FactoryTalk AssetCentre	unspecified – through v10.00

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-091-01 x_refsource_CONFIRM
https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831 x_refsource_CONFIRM