CVE-2021-27474
📋 TL;DR
This vulnerability in Rockwell Automation FactoryTalk AssetCentre allows remote, unauthenticated attackers to modify sensitive data by exploiting insufficient restrictions on IIS remoting services. It affects FactoryTalk AssetCentre v10.00 and earlier versions. Organizations using these versions in industrial control systems are at risk.
💻 Affected Systems
- Rockwell Automation FactoryTalk AssetCentre
📦 What is this software?
Factorytalk Assetcentre by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems, unauthorized modification of critical operational data, potential disruption of manufacturing processes, and safety system manipulation.
Likely Case
Unauthorized data modification in FactoryTalk AssetCentre, potential configuration changes affecting asset management, and possible lateral movement within industrial networks.
If Mitigated
Limited impact with proper network segmentation, but still poses risk to isolated systems if exploited internally.
🎯 Exploit Status
CVSS 10.0 indicates trivial exploitation with maximum impact. No public PoC known but weaponization is likely given the critical nature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FactoryTalk AssetCentre v10.01 or later
Vendor Advisory: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130831
Restart Required: Yes
Instructions:
1. Download FactoryTalk AssetCentre v10.01 or later from Rockwell Automation support portal. 2. Backup current configuration and data. 3. Install the updated version following vendor instructions. 4. Restart the system and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate FactoryTalk AssetCentre systems from untrusted networks and implement strict firewall rules.
IIS Service Restriction
windowsConfigure IIS to restrict access to remoting services to authorized IP addresses only.
netsh advfirewall firewall add rule name="Block FactoryTalk IIS" dir=in action=block protocol=TCP localport=80,443 remoteip=any
🧯 If You Can't Patch
- Implement strict network segmentation and zero-trust architecture around FactoryTalk AssetCentre systems
- Deploy intrusion detection systems and monitor for unauthorized access attempts to IIS remoting services
🔍 How to Verify
Check if Vulnerable:
Check FactoryTalk AssetCentre version in Control Panel > Programs and Features. Versions 10.00 or earlier are vulnerable.Check Version:
wmic product where name="FactoryTalk AssetCentre" get versionVerify Fix Applied:
Verify installation of FactoryTalk AssetCentre v10.01 or later and confirm IIS remoting service restrictions are properly configured.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to IIS remoting services in Windows Event Logs
- Unexpected modifications to FactoryTalk AssetCentre configuration files
Network Indicators:
- Unusual traffic patterns to FactoryTalk AssetCentre IIS services on ports 80/443
- Unauthorized remote connections to asset management systems
SIEM Query:
source="windows" AND (event_id=4625 OR event_id=4648) AND process_name="w3wp.exe" AND destination_port IN (80, 443)🔗 References
- https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-091-01
- https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-091-01
