PT-2021-6479 · Rockwell Automation · Connected Components Workbench

Mashav Sapir · Published 2021-02-19 · Updated 2022-03-29 · CVE-2021-27475

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation Connected Components Workbench version 12.00.00 and prior

Description The issue is related to the deserialization of objects, which can be exploited by attackers to craft malicious objects. If a local user opens such an object in Connected Components Workbench, it may result in remote code execution. This requires user interaction to be successfully exploited. The vulnerability is also associated with the recovery of invalid data in memory, allowing an attacker to execute arbitrary code.

Recommendations For versions 12.00.00 and prior, consider restricting the use of the deserialization feature in Connected Components Workbench until a patch is available. As a temporary workaround, avoid opening suspicious or untrusted files in Connected Components Workbench to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2022-01723

CVE-2021-27475

Affected Products

Connected Components Workbench

References · 7

• https://osv.dev/vulnerability/CVE-2021-27475 · Vendor Advisory
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131435 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27475 · Security Note
• https://bdu.fstec.ru/vul/2022-01723 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021051401 · Note
• https://vuldb.com/?id.195658 · Note
• https://cisa.gov/uscert/ics/advisories/icsa-21-133-01 · Note