Deserialization of untrusted data

2022-03-2320:15:00

PRIOn knowledge base

www.prio-n.com

9.7 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.3%

JSON

A deserialization vulnerability exists in how the ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.

CPENameOperatorVersion
factorytalk_assetcentrele10.00

CPE	Name	Operator	Version
	factorytalk_assetcentre	le	10.00

References

idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831

www.cisa.gov/uscert/ics/advisories/icsa-21-091-01