Riskcovery

CVE-2021-27475

Rockwell Automation Connected Components Workbench Deserialization of Untrusted Data

State
Published
Severity
8.6 High
Published
Mar 23, 2022
Updated
Apr 16, 2025
Reserved
Feb 19, 2021

Read the record on cve.org

Description

Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in remote code execution. This vulnerability requires user interaction to be successfully exploited.

Scores

CVSSScoreVectorSource
3.18.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Hicscert

Weaknesses

  • CWE-502 Deserialization of Untrusted Data

Affected Products

ProductVersions
Connected Components WorkbenchRockwell Automation
  • v12.00.00 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.