PT-2021-15160 · Rockwell Automation · Drivetools Sp+1

Published 2021-03-18 · Updated 2021-03-25 · CVE-2021-22665

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation DriveTools SP versions 5.13 and below Rockwell Automation Drives AOP versions 4.12 and below

Description A local attacker with limited privileges may be able to exploit the issue, resulting in privilege escalation and complete control of the system.

Recommendations For Rockwell Automation DriveTools SP versions 5.13 and below, update to a version above 5.13 to resolve the issue. For Rockwell Automation Drives AOP versions 4.12 and below, update to a version above 4.12 to resolve the issue.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2021-22665

Affected Products

Drivetools Sp

Drives Aop

References · 5

• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1129798 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22665 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22665 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-21-042-02 · Note
• https://t.me/cibsecurity/25142 · Telegram Post