CVE-2021-27476

Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk AssetCentre versions prior to 10.00

Description A vulnerability exists in the SaveConfigFile function of the RACompare Service, which may allow for OS command injection. This issue may allow a remote, unauthenticated attacker to execute arbitrary commands. The vulnerability is due to the lack of measures to neutralize special elements used in the operating system command.

Recommendations For versions prior to 10.00, consider disabling the SaveConfigFile function of the RACompare Service as a temporary workaround until a patch is available. Restrict access to the RACompare Service to minimize the risk of exploitation. Avoid using the SaveConfigFile function in the RACompare Service until the issue is resolved.