A CVSS v3 base score of 10.0 has been calculated the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.ĬVE-2021-27470 has been assigned to this vulnerability. 3.2.3 DESERIALIZATION OF UNTRUSTED DATA CWE-502Ī deserialization vulnerability exists in how the LogService.rem service in FactoryTalk AssetCentre verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.ĬVE-2021-27466 has been assigned to this vulnerability. 3.2.2 DESERIALIZATION OF UNTRUSTED DATA CWE-502Ī deserialization vulnerability exists in how the ArchiveService.rem service in FactoryTalk AssetCentre verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.ĬVE-2021-27462 has been assigned to this vulnerability. FactoryTalk AssetCentre, v10.00 and earlierģ.2 VULNERABILITY OVERVIEW 3.2.1 DESERIALIZATION OF UNTRUSTED DATA CWE-502Ī deserialization vulnerability exists in how the AosService.rem service in FactoryTalk AssetCentre verifies serialized data.Rockwell Automation reports these vulnerabilities affects the following products: Successful exploitation of these vulnerabilities may allow unauthenticated attackers to perform arbitrary command execution, SQL injection, or remote code execution. Vulnerabilities: OS Command Injection, Deserialization of Untrusted Data, SQL Injection, Improperly Restricted Functions.ATTENTION: Exploitable remotely/Low attack complexity.

Factorytalk assetcentre client download