What is CVE-2021-27472?

CVE-2021-27472 is a critical-severity vulnerability in Rockwell Automation Factorytalk Assetcentre, classified under SQL Injection. CVSS score: 10.0/10. Published 2022-03-23.

How severe is CVE-2021-27472?

Critical severity. CVSS v3 base score is 10.0 out of 10.

SQL Injection in Rockwell Automation Factorytalk Assetcentre

CVE-2021-27472

A vulnerability exists in the RunSearch function of SearchService service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier, which may allow for the execution of remote unauthenticated arbitrary SQL statements.

Vulnerability class: SQL Injection

EPSS: 0.053 (91.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H.

Affected products

Rockwell Automation Factorytalk Assetcentre — versions unspecified
Rockwellautomation Factorytalk_assetcentre

Weakness classification (CWE)

CWE-89 — SQL Injection

References

ics-cert@hq.dhs.gov (x_refsource_CONFIRM, US Government Resource, Third Party Advisory, Mitigation)
ics-cert@hq.dhs.gov (Vendor Advisory, Permissions Required, x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2021-27472?: CVE-2021-27472 is a critical-severity vulnerability in Rockwell Automation Factorytalk Assetcentre, classified under SQL Injection. CVSS score: 10.0/10. Published 2022-03-23.
How severe is CVE-2021-27472?: Critical severity. CVSS v3 base score is 10.0 out of 10.