Sign-up

ID

VAR-202105-1523


CVE

CVE-2021-27475


TITLE

Rockwell Automation  Made  Connected Components Workbench  Multiple vulnerabilities in

Trust: 0.8

sources: JVNDB: JVNDB-2021-001430

DESCRIPTION

Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in remote code execution. This vulnerability requires user interaction to be successfully exploited. * Deserialization of untrusted data (CWE-502) - CVE-2021-27475 ‥ * Path traversal (CWE-22) - CVE-2021-27471 ‥ * Incorrect input confirmation (CWE-20) - CVE-2021-27473The expected impact depends on each vulnerability, but it may be affected as follows. - CVE-2021-27475 ‥ * When a local user opens a malicious file created by a third party with the corresponding product, the existing file is overwritten or a new file is created with the authority of the corresponding product. - CVE-2021-27471 ‥ * Illegal created by a malicious user .ccwarc By opening the archive file with the corresponding product, the authority of the product is acquired. - CVE-2021-27473. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. An automatic programming software

Trust: 2.25

sources: NVD: CVE-2021-27475 // JVNDB: JVNDB-2021-001430 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-386742

AFFECTED PRODUCTS

vendor:rockwellautomationmodel:connected components workbenchscope:lteversion:12.00.00

Trust: 1.0

vendor:rockwell automationmodel:connected components workbenchscope:eqversion: -

Trust: 0.8

vendor:rockwell automationmodel:connected components workbenchscope:lteversion:v12.00.00 and earlier

Trust: 0.8

sources: JVNDB: JVNDB-2021-001430 // NVD: CVE-2021-27475

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-27475
value: HIGH

Trust: 1.0

ics-cert@hq.dhs.gov: CVE-2021-27475
value: HIGH

Trust: 1.0

IPA: JVNDB-2021-001430
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202105-805
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

VULHUB: VHN-386742
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-27475
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-386742
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-27475
baseSeverity: HIGH
baseScore: 8.6
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 6.0
version: 3.1

Trust: 2.0

IPA: JVNDB-2021-001430
baseSeverity: HIGH
baseScore: 8.6
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-386742 // JVNDB: JVNDB-2021-001430 // CNNVD: CNNVD-202105-805 // CNNVD: CNNVD-202104-975 // NVD: CVE-2021-27475 // NVD: CVE-2021-27475

PROBLEMTYPE DATA

problemtype:CWE-502

Trust: 1.1

problemtype:Incorrect input confirmation (CWE-20) [IPA Evaluation ]

Trust: 0.8

problemtype: Path traversal (CWE-22) [IPA Evaluation ]

Trust: 0.8

problemtype: Deserialization of untrusted data (CWE-502) [IPA Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-386742 // JVNDB: JVNDB-2021-001430 // NVD: CVE-2021-27475

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202105-805

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202105-805

PATCH

title:industrial security advisory from Rockwell Automation ( Login required )url:https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1131435

Trust: 0.8

title:Rockwell Automation Connected Components Workbench Fixes for code issue vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=150448

Trust: 0.6

sources: JVNDB: JVNDB-2021-001430 // CNNVD: CNNVD-202105-805

EXTERNAL IDS

db:ICS CERTid:ICSA-21-133-01

Trust: 2.5

db:NVDid:CVE-2021-27475

Trust: 2.5

db:JVNid:JVNVU95873084

Trust: 0.8

db:JVNDBid:JVNDB-2021-001430

Trust: 0.8

db:AUSCERTid:ESB-2021.1650

Trust: 0.6

db:CS-HELPid:SB2021051401

Trust: 0.6

db:CNNVDid:CNNVD-202105-805

Trust: 0.6

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:VULHUBid:VHN-386742

Trust: 0.1

sources: VULHUB: VHN-386742 // JVNDB: JVNDB-2021-001430 // CNNVD: CNNVD-202105-805 // CNNVD: CNNVD-202104-975 // NVD: CVE-2021-27475

REFERENCES

url:https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131435

Trust: 1.7

url:https://www.cisa.gov/uscert/ics/advisories/icsa-21-133-01

Trust: 1.7

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-133-01

Trust: 1.4

url:http://jvn.jp/cert/jvnvu95873084

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2021-27475/

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021051401

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1650

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

sources: VULHUB: VHN-386742 // JVNDB: JVNDB-2021-001430 // CNNVD: CNNVD-202105-805 // CNNVD: CNNVD-202104-975 // NVD: CVE-2021-27475

SOURCES

db:VULHUBid:VHN-386742
db:JVNDBid:JVNDB-2021-001430
db:CNNVDid:CNNVD-202105-805
db:CNNVDid:CNNVD-202104-975
db:NVDid:CVE-2021-27475

LAST UPDATE DATE

2024-08-14T12:14:56.019000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-386742date:2022-03-29T00:00:00
db:JVNDBid:JVNDB-2021-001430date:2021-05-17T08:36:00
db:CNNVDid:CNNVD-202105-805date:2022-03-30T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:NVDid:CVE-2021-27475date:2022-03-29T17:59:46.810

SOURCES RELEASE DATE

db:VULHUBid:VHN-386742date:2022-03-23T00:00:00
db:JVNDBid:JVNDB-2021-001430date:2021-05-17T00:00:00
db:CNNVDid:CNNVD-202105-805date:2021-05-13T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:NVDid:CVE-2021-27475date:2022-03-23T20:15:09.270