CVE-2021-27472
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to execute arbitrary SQL statements against Rockwell Automation FactoryTalk AssetCentre databases. It affects all versions up to v10.00, potentially compromising industrial control system asset management data and operations.
💻 Affected Systems
- Rockwell Automation FactoryTalk AssetCentre
📦 What is this software?
Factorytalk Assetcentre by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of FactoryTalk AssetCentre database leading to data theft, manipulation of industrial asset configurations, and potential lateral movement to connected industrial control systems.
Likely Case
Unauthorized access to sensitive asset information, configuration data exfiltration, and potential denial of service through database manipulation.
If Mitigated
Limited impact if network segmentation prevents external access and proper authentication controls are in place.
🎯 Exploit Status
SQL injection vulnerabilities are commonly weaponized. The unauthenticated nature and CVSS 10.0 score make this particularly attractive to attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v10.01 or later
Vendor Advisory: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130831
Restart Required: Yes
Instructions:
1. Download FactoryTalk AssetCentre v10.01 or later from Rockwell Automation support portal. 2. Backup current configuration and database. 3. Run installer with administrative privileges. 4. Restart services and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate FactoryTalk AssetCentre servers from untrusted networks and internet access.
Firewall Rules
allRestrict access to FactoryTalk AssetCentre ports (typically 443/HTTPS) to authorized IP addresses only.
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to FactoryTalk AssetCentre servers
- Deploy web application firewall (WAF) with SQL injection protection rules in front of the service
🔍 How to Verify
Check if Vulnerable:
Check FactoryTalk AssetCentre version in Control Panel > Programs and Features. Versions 10.00 or earlier are vulnerable.Check Version:
wmic product where name="FactoryTalk AssetCentre" get versionVerify Fix Applied:
Verify version is 10.01 or later and test search functionality to ensure SQL injection attempts are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in database logs
- Multiple failed authentication attempts followed by search requests
- Unexpected database schema changes or data exports
Network Indicators:
- SQL injection patterns in HTTP POST requests to SearchService endpoints
- Unusual outbound database connections from FactoryTalk servers
SIEM Query:
source="FactoryTalk" AND (url="*RunSearch*" AND (payload="*' OR *" OR payload="*;--*" OR payload="*UNION*"))🔗 References
- https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-091-01
- https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-091-01
