VULNERABILITY INTELLIGENCE

CVE-2021-27472

CVSS score10 CRITICAL

EPSS probability5.66%

CISA KEVNot currently listed

Published2022-03-23

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

Description

A vulnerability exists in the RunSearch function of SearchService service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier, which may allow for the execution of remote unauthenticated arbitrary SQL statements.

Weakness classification

ics-cert@hq.dhs.gov: CWE-89
nvd@nist.gov: CWE-89

Primary references

ics-cert@hq.dhs.gov — Permissions Required, Vendor Advisory
ics-cert@hq.dhs.gov — Mitigation, Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Third Party Advisory, US Government Resource