Skip to content
OpenAdvisories
High ICSA-21-133-01 3 CVEs

Rockwell Automation Connected Components Workbench

Published May 13, 2021 · Updated May 13, 2021

Vendor: Rockwell Automation Product: Connected Components Workbench

Summary

Successful exploitation of these vulnerabilities may allow remote code execution, authentication bypass, or privilege escalation.

Vulnerabilities 3

  • High 8.6
    CVE-2021-27475

    Rockwell Automation Connected Components Workbench Deserialization of Untrusted Data

    Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Work…

    Rockwell Automation Connected Components Workbench ICS / OT
  • High 7.7
    CVE-2021-27471

    Rockwell Automation Connected Components Workbench Path Traversal

    The parsing mechanism that processes certain file types does not provide input sanitization for file paths. This may allow an attacker to craft malicious files that, when opened by Rockwell Automation Connected Components Workbench v12.00.00 and prior, can tr…

    Rockwell Automation Connected Components Workbench ICS / OT
  • Medium 6.1
    CVE-2021-27473

    Rockwell Automation Connected Components Workbench Improper Input Validation

    Rockwell Automation Connected Components Workbench v12.00.00 and prior does not sanitize paths specified within the .ccwarc archive file during extraction. This type of vulnerability is also commonly referred to as a Zip Slip. A local, authenticated attacker …

    Rockwell Automation Connected Components Workbench ICS / OT

Revision history

  1. #1

    ICSA-21-133-01 Rockwell Automation Connected Components Workbench

References