Critical · published March 23, 2022
🚨 A remote attacker can execute arbitrary commands with a single API call! This OS command injection vulnerability in the RACompare Service is like giving a stranger a master key to your factory. 🔥 Think of it as a restaurant where an employee can slip an unauthorized order directly to the kitchen — without anyone verifying if that order makes sense. This flaw lets attackers bypass all security checks and run their own commands as if they were trusted users. An attacker could not only access sensitive data but also alter system configurations or even take complete control of the FactoryTalk AssetCentre environment. The implications could be absolutely devastating, leading to operational disruptions and security breaches across critical systems.
Think of it as a restaurant where an employee can slip an unauthorized order directly to the kitchen — without anyone verifying if that order makes sense. This flaw lets attackers bypass all security checks and run their own commands as if they were trusted users. The vulnerability exists in the SaveConfigFile function, where inadequate input validation allows unauthenticated users to inject and execute commands on the operating system level.
An attacker could not only access sensitive data but also alter system configurations or even take complete control of the FactoryTalk AssetCentre environment. The implications could be absolutely devastating, leading to operational disruptions and security breaches across critical systems. Patch your FactoryTalk AssetCentre to version 10.01 or later immediately. Additionally, audit configurations and limit access to the RACompare Service to trusted networks only. Keep an eye on your security updates to ensure you stay one step ahead! This is fixable! Act now, and you'll have this secured in no time! 🛡️