CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2025-0477 – Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability
https://notcve.org/view.php?id=CVE-2025-0477
30 Jan 2025 — An encryption vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to a weak encryption methodology and could allow a threat actor to extract passwords belonging to other users of the application. • https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1721.html • CWE-522: Insufficiently Protected Credentials •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2025-0497 – Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability
https://notcve.org/view.php?id=CVE-2025-0497
30 Jan 2025 — A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to storing credentials in the configuration file of EventLogAttachmentExtractor, ArchiveExtractor, LogCleanUp, or ArchiveLogCleanUp packages. • https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1721.html • CWE-522: Insufficiently Protected Credentials •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2025-0498 – Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability
https://notcve.org/view.php?id=CVE-2025-0498
30 Jan 2025 — A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to insecure storage of FactoryTalk® Security user tokens, which could allow a threat actor to steal a token and, impersonate another user. • https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1721.html • CWE-522: Insufficiently Protected Credentials •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27476 – Rockwell Automation FactoryTalk AssetCentre OS Command Injection
https://notcve.org/view.php?id=CVE-2021-27476
23 Mar 2022 — A vulnerability exists in the SaveConfigFile function of the RACompare Service, which may allow for OS command injection. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier. Se presenta una vulnerabilidad en la función SaveConfigFile del servicio RACompare, que puede permitir una inyección de comandos del Sistema Operativo. Esta vulnerabilidad puede permitir a un atacante remoto no autenticado ejecut... • https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27470 – Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data
https://notcve.org/view.php?id=CVE-2021-27470
23 Mar 2022 — A deserialization vulnerability exists in how the LogService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre. Se presenta una vulnerabilidad de deserialización en la forma en que el servicio LogService.rem de Rockwell Automation FactoryTalk AssetCentre versiones v10.00 y anteriores, verifica los datos serializados. Esta vulnerabilida... • https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831 • CWE-502: Deserialization of Untrusted Data •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27466 – Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data
https://notcve.org/view.php?id=CVE-2021-27466
23 Mar 2022 — A deserialization vulnerability exists in how the ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre. Se presenta una vulnerabilidad de deserialización en la forma en que el servicio ArchiveService.rem de Rockwell Automation FactoryTalk AssetCentre versiones v10.00 y anteriores, verifica los datos serializados. Esta vulne... • https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831 • CWE-502: Deserialization of Untrusted Data •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27474 – Rockwell Automation FactoryTalk AssetCentre Use of Potentially Dangerous Function
https://notcve.org/view.php?id=CVE-2021-27474
23 Mar 2022 — Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier does not properly restrict all functions relating to IIS remoting services. This vulnerability may allow a remote, unauthenticated attacker to modify sensitive data in FactoryTalk AssetCentre. Rockwell Automation FactoryTalk AssetCentre versiones v10.00 y anteriores, no restringen apropiadamente todas las funciones relacionadas con los servicios de remoting de IIS. Esta vulnerabilidad puede permitir que un atacante remoto no autenticado modifiqu... • https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831 • CWE-676: Use of Potentially Dangerous Function •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27468 – Rockwell Automation FactoryTalk AssetCentre SQL Injection
https://notcve.org/view.php?id=CVE-2021-27468
23 Mar 2022 — The AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements. El servicio AosService.rem de Rockwell Automation FactoryTalk AssetCentre versiones v10.00 y anteriores expone funciones que carecen de la autenticación apropiada. Esta vulnerabilidad puede permitir a un atacante remoto no autenticado ejecutar sentencias SQL arbitraria... • https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27472 – Rockwell Automation FactoryTalk AssetCentre SQL Injection
https://notcve.org/view.php?id=CVE-2021-27472
23 Mar 2022 — A vulnerability exists in the RunSearch function of SearchService service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier, which may allow for the execution of remote unauthenticated arbitrary SQL statements. Se presenta una vulnerabilidad en la función RunSearch del servicio SearchService de Rockwell Automation FactoryTalk AssetCentre versiones v10.00 y anteriores, que puede permitir una ejecución de sentencias SQL arbitrarias remotas no autenticadas • https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27462 – Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data
https://notcve.org/view.php?id=CVE-2021-27462
23 Mar 2022 — A deserialization vulnerability exists in how the AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre. Se presenta una vulnerabilidad de deserialización en la forma en que el servicio AosService.rem de Rockwell Automation FactoryTalk AssetCentre versiones v10.00 y anteriores, verifica los datos serializados. Esta vulnerabilida... • https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F1130831 • CWE-502: Deserialization of Untrusted Data •