CVE-2021-27476 Explained : Impact and Mitigation

A critical vulnerability, CVE-2021-27476, has been identified in Rockwell Automation FactoryTalk AssetCentre that could potentially enable a remote, unauthenticated attacker to execute arbitrary commands through OS command injection. This CVE affects versions up to v10.00 of the software.

Understanding CVE-2021-27476

This section delves into the details of the CVE-2021-27476 vulnerability in Rockwell Automation FactoryTalk AssetCentre.

What is CVE-2021-27476?

The vulnerability lies in the SaveConfigFile function of the RACompare Service, allowing for OS command injection. This flaw may grant unauthorized users the ability to execute commands on the affected system.

The Impact of CVE-2021-27476

With a CVSS base score of 10, denoting a critical severity, this vulnerability can lead to high confidentiality impact and availability impact, potentially resulting in significant security breaches.

Technical Details of CVE-2021-27476

Let's explore the technical aspects related to CVE-2021-27476.

Vulnerability Description

The vulnerability in the RACompare Service's SaveConfigFile function permits remote, unauthenticated attackers to engage in OS command injection, posing a serious security risk.

Affected Systems and Versions

Rockwell Automation FactoryTalk AssetCentre versions up to v10.00 are susceptible to this OS command injection vulnerability.

Exploitation Mechanism

Through the vulnerable SaveConfigFile function, malicious actors can exploit the system remotely by executing arbitrary commands.

Mitigation and Prevention

To address and mitigate the risks associated with CVE-2021-27476, certain steps and strategies need to be implemented.

Immediate Steps to Take

Users of affected versions are urged to update to FactoryTalk AssetCentre v11 or above to remediate the vulnerability. Refer to Rockwell Automation's KnowledgeBase ID: PN1559 for detailed guidance.

Long-Term Security Practices

For users unable to upgrade immediately, utilizing built-in security functionalities within FactoryTalk AssetCentre is recommended. Implement IPsec to reduce exposure to unauthorized clients and diligently follow the provided guidance.

Patching and Updates

Ensure software is run under user privileges, deploy allow-list applications like Microsoft AppLocker, follow the principle of least privilege, use trusted software and patches, and restrict network accessibility to minimize security risks.