PT-2022-9833 · Rockwell Automation · Factorytalk Assetcentre

Published 2022-03-23 · Updated 2022-07-29 · CVE-2021-27474

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk AssetCentre versions 10.00 and earlier

Description The issue is related to improper restriction of functions related to IIS remoting services, which may allow a remote, unauthenticated attacker to modify sensitive data.

Recommendations For versions 10.00 and earlier, update to a version later than 10.00 to resolve the issue.

Fix

Weakness Enumeration

CWE-676

Related Identifiers

CVE-2021-27474

Affected Products

Factorytalk Assetcentre

References · 4

• https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27474 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27474 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-21-091-01 · Note