SQL Injection in Rockwell Automation Factorytalk Assetcentre
CVE-2021-27472
A vulnerability exists in the RunSearch function of SearchService service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier, which may allow for the execution of remote unauthenticated arbitrary SQL statements.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H.
EPSS exploit prediction
EPSS: 0.057 (92.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 93rd percentile — 92.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.057 · newest: 0.057 · change: 0.000
Affected products
- Rockwell Automation Factorytalk Assetcentre — versions unspecified
- Rockwellautomation Factorytalk Assetcentre
Weakness classification (CWE)
References
- www.cisa.gov/uscert/ics/advisories/icsa-21-091-01 (US Government Resource, Third Party Advisory, Mitigation)
- idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx (Vendor Advisory, Permissions Required)
Frequently asked questions
- What is CVE-2021-27472?
- CVE-2021-27472 is a critical-severity vulnerability in Rockwell Automation Factorytalk Assetcentre, classified under SQL Injection. CVSS score: 10.0/10. Published 2022-03-23.
- How severe is CVE-2021-27472?
- Critical severity. CVSS v3 base score is 10.0 out of 10.