CVE-2021-27475 : What You Need to Know

This article provides details about CVE-2021-27475, a vulnerability in Rockwell Automation Connected Components Workbench that allows attackers to execute remote code through crafted malicious objects.

Understanding CVE-2021-27475

CVE-2021-27475 is a security vulnerability found in the Connected Components Workbench software by Rockwell Automation, specifically affecting versions prior to v12.00.00. The flaw enables threat actors to exploit the deserialization of untrusted data, leading to potential remote code execution.

What is CVE-2021-27475?

The vulnerability in Rockwell Automation Connected Components Workbench v12.00.00 and earlier versions allows attackers to create malicious serialized objects. When a local user opens these objects in the software, it may trigger remote code execution. Exploiting this vulnerability requires user interaction to succeed.

The Impact of CVE-2021-27475

This vulnerability poses a high risk as it can result in the compromise of confidentiality, integrity, and availability of systems running the affected software. Attackers could exploit this flaw to execute arbitrary code on a victim's machine, potentially leading to severe consequences.

Technical Details of CVE-2021-27475

Below are some technical details of CVE-2021-27475:

Vulnerability Description

Rockwell Automation Connected Components Workbench v12.00.00 and earlier versions do not restrict deserialization of objects, allowing the creation and execution of malicious serialized objects by attackers.

Affected Systems and Versions

The vulnerability affects Connected Components Workbench versions up to v12.00.00.

Exploitation Mechanism

To exploit this vulnerability, an attacker needs to craft a malicious serialized object and trick a local user into opening it within Connected Components Workbench, hence requiring user interaction for successful exploitation.

Mitigation and Prevention

To address CVE-2021-27475 and enhance security, consider the following mitigation strategies:

Immediate Steps to Take

Update to Connected Components Workbench v13.00.00 or later to mitigate the risk.
Run the software as a User, not as an Administrator, to minimize the impact of malicious code.
Avoid opening untrusted .ccwarc files to prevent potential attacks.

Long-Term Security Practices

Implement training programs for users on identifying phishing attacks.
Consider using allow-list applications such as Microsoft AppLocker to reduce risks.
Follow the principle of least privilege for user access.

Patching and Updates

Ensure timely software updates and follow Rockwell Automation's industrial security advisory for additional information.