PT-2022-9830 · Rockwell Automation · Factorytalk Assetcentre

Published 2022-03-23 · Updated 2022-03-29 · CVE-2021-27468

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk AssetCentre versions prior to 10.00

Description The issue concerns the AosService.rem service, which exposes functions without proper authentication, potentially allowing a remote, unauthenticated attacker to execute arbitrary SQL statements.

Recommendations For versions prior to 10.00, update to a version that includes proper authentication for the AosService.rem service to prevent unauthorized access.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-27468

Affected Products

Factorytalk Assetcentre

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-27468 · Security Note
• https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27468 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-21-091-01 · Note