CVE-2021-27476
📋 TL;DR
This vulnerability allows remote, unauthenticated attackers to execute arbitrary operating system commands on Rockwell Automation FactoryTalk AssetCentre systems. The command injection occurs in the SaveConfigFile function of the RACompare Service, potentially giving attackers full control over affected systems. Organizations running FactoryTalk AssetCentre v10.00 or earlier are affected.
💻 Affected Systems
- Rockwell Automation FactoryTalk AssetCentre
📦 What is this software?
Factorytalk Assetcentre by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install malware, steal sensitive industrial data, disrupt operations, or pivot to other critical infrastructure systems.
Likely Case
Attackers gain remote code execution to deploy ransomware, establish persistence, or exfiltrate sensitive industrial control system data.
If Mitigated
With proper network segmentation and access controls, impact is limited to the isolated AssetCentre system without affecting production environments.
🎯 Exploit Status
The vulnerability is straightforward to exploit with publicly available proof-of-concept code. Remote unauthenticated access makes it attractive for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FactoryTalk AssetCentre v10.01 and later
Vendor Advisory: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130831
Restart Required: Yes
Instructions:
1. Download FactoryTalk AssetCentre v10.01 or later from Rockwell Automation's website. 2. Backup current configuration and data. 3. Install the updated version following vendor instructions. 4. Restart the system to apply changes.
🔧 Temporary Workarounds
Network Segmentation
allIsolate FactoryTalk AssetCentre systems from untrusted networks and internet access
Configure firewall rules to block inbound traffic to TCP ports used by FactoryTalk AssetCentre (default ports vary by installation)
Service Restriction
windowsDisable or restrict access to the RACompare Service if not required
Windows Firewall: netsh advfirewall firewall add rule name="Block RACompare" dir=in action=block protocol=TCP localport=[PORT_NUMBER]
Service Control: sc config "FactoryTalk AssetCentre RACompare Service" start= disabled
🧯 If You Can't Patch
- Implement strict network segmentation to isolate AssetCentre systems from production networks and internet
- Deploy application whitelisting to prevent execution of unauthorized commands and binaries
🔍 How to Verify
Check if Vulnerable:
Check FactoryTalk AssetCentre version in Control Panel > Programs and Features. Versions 10.00 or earlier are vulnerable.Check Version:
wmic product where name="FactoryTalk AssetCentre" get versionVerify Fix Applied:
Verify installation of v10.01 or later and ensure the RACompare Service is updated. Check vendor patch notes for specific fixes applied.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in Windows Event Logs (Event ID 4688)
- Suspicious process creation by the RACompare Service
- Failed authentication attempts followed by successful command execution
Network Indicators:
- Unusual outbound connections from AssetCentre systems
- Traffic to known malicious IPs or domains
- Anomalous patterns in RACompare Service communications
SIEM Query:
source="windows" AND (process_name="cmd.exe" OR process_name="powershell.exe") AND parent_process="RACompareService.exe"🔗 References
- https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-091-01
- https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-091-01
