Vulnerability · Published Mar 23, 2022 · Assigned by icscert
CVE-2021-27471Rockwell Automation Connected Components Workbench Path Traversal
High 7.7
In plain English
A high-severity path traversal in Connected Components Workbench from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities).
Official description
The parsing mechanism that processes certain file types does not provide input sanitization for file paths. This may allow an attacker to craft malicious files that, when opened by Rockwell Automation Connected Components Workbench v12.00.00 and prior, can traverse the file system. If successfully exploited, an attacker could overwrite existing files and create additional files with the same permissions of the Connected Components Workbench software. User interaction is required for this exploit to be successful.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | Connected Components Workbench | unspecified – through v12.00.00 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-133-01 x_refsource_CONFIRM
- https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131435 x_refsource_CONFIRM