Lucene search

IcscertCVE-2021-27475

HistoryMar 23, 2022 - 8:15 p.m.

CVE-2021-27475

2022-03-2320:15:09

CWE-502

icscert

web.nvd.nist.gov

cve-2021-27475

rockwell automation

connected components workbench

ccw

deserialization

remote code execution

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.6

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

47.5%

JSON

Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in remote code execution. This vulnerability requires user interaction to be successfully exploited.

Affected configurations

Nvd

Node

rockwellautomationconnected_components_workbenchRange≤12.00.00

VendorProductVersionCPE
rockwellautomationconnected_components_workbench*cpe:2.3:a:rockwellautomation:connected_components_workbench:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rockwellautomation	connected_components_workbench	*	cpe:2.3:a:rockwellautomation:connected_components_workbench::::::::

CNA Affected

[
  {
    "product": "Connected Components Workbench",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "lessThanOrEqual": "v12.00.00",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131435

www.cisa.gov/uscert/ics/advisories/icsa-21-133-01

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.6

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

47.5%

JSON

Related for CVE-2021-27475