10.0 Critical

CVE-2021-27476 A vulnerability exists in the SaveConfigFile function of the RACompare Service, which may allow for OS command injection

Description

A vulnerability exists in the SaveConfigFile function of the RACompare Service, which may allow for OS command injection. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier.

Affected products and versions

Product	Affected versions	Fixed in
FactoryTalk AssetCentre 10.00	earliest → 10.00	No fix stated

The 9 CVEs of FactoryTalk AssetCentre →

CVE-2021-27470 A deserialization vulnerability exists in how the LogService.rem service in Rockwell Automation FactoryTalk… 10.0 Critical CVE-2021-27466 A deserialization vulnerability exists in how the ArchiveService.rem service in Rockwell Automation FactoryTalk… 10.0 Critical CVE-2021-27474 Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier does not properly restrict all functions relating to… 10.0 Critical CVE-2021-27468 The AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking… 10.0 Critical

Do you use FactoryTalk AssetCentre?

Track this CVE Watch FactoryTalk AssetCentre Check my SBOMs

www.cveye.io/en/cve/CVE-2021-27476

Timeline

Published March 23, 2022
Last modified April 16, 2025

References

www.cisa.gov www.cisa.gov
idp.rockwellautomation.com idp.rockwellautomation.com

Track this CVE

CVE-2021-27476 A vulnerability exists in the SaveConfigFile function of the RACompare Service, which may allow for OS command injection

Description

Affected products and versions

Other CVEs of FactoryTalk AssetCentre