CVE-2021-27473

Name of the Vulnerable Software and Affected Versions Rockwell Automation Connected Components Workbench version 12.00.00 and prior

Description The issue is related to the software's failure to sanitize paths within the .ccwarc archive file during extraction, also known as a Zip Slip vulnerability. A local, authenticated attacker can create a malicious .ccwarc archive file to gain the privileges of the software. If the software is running at SYSTEM level, the attacker will gain admin level privileges. User interaction is required for this exploit to be successful.

Recommendations For Rockwell Automation Connected Components Workbench version 12.00.00 and prior, consider restricting access to the .ccwarc archive file until a patch is available. As a temporary workaround, avoid opening untrusted .ccwarc archive files with Connected Components Workbench to minimize the risk of exploitation.