Critical severity · published Mar 23, 2022
CVE-2021-27460
Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data
9.8
CVSS
3.2%
EPSS
No
On KEV
Description
Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier components contain .NET remoting endpoints that deserialize untrusted data without sufficiently verifying that the resulting data will be valid. This vulnerability may allow a remote, unauthenticated attacker to gain full access to the FactoryTalk AssetCentre main server and all agent machines.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
FactoryTalk AssetCentre · Rockwell Automation
through v10.00 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27460
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27460
Permissions Required
https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-21-091-01
More from FactoryTalk AssetCentre
9.8
CVE-2025-0477
Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability
9.8
CVE-2025-0497
Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability
9.8
CVE-2025-0498
Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability
9.8
CVE-2021-27476
Rockwell Automation FactoryTalk AssetCentre OS Command Injection
9.8
CVE-2021-27470
Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data