Lucene search

[email protected]CVE-2022-1118

HistoryMay 17, 2022 - 8:15 p.m.

CVE-2022-1118

2022-05-1720:15:00

CWE-502

[email protected]

web.nvd.nist.gov

cve-2022-1118

information security

vulnerability

connected components workbench

isagraf workbench

safety instrumented system workstation

arbitrary code execution

user interaction

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

20.8%

JSON

Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for Trusted Controllers)) do not limit the objects that can be deserialized. This allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in arbitrary code execution. This vulnerability requires user interaction to be successfully exploited

CPENameOperatorVersion
rockwellautomation:safety_instrumented_systems_workstationrockwellautomation safety instrumented systems workstationle1.2
rockwellautomation:isagraf_workbenchrockwellautomation isagraf workbenchle6.6.9
rockwellautomation:connected_component_workbenchrockwellautomation connected component workbenchle13.00.00

CPE	Name	Operator	Version
rockwellautomation:safety_instrumented_systems_workstation	rockwellautomation safety instrumented systems workstation	le	1.2
rockwellautomation:isagraf_workbench	rockwellautomation isagraf workbench	le	6.6.9
rockwellautomation:connected_component_workbench	rockwellautomation connected component workbench	le	13.00.00

References

www.cisa.gov/uscert/ics/advisories/icsa-22-095-01

Social References

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

20.8%

JSON

Related for CVE-2022-1118

zdi4 prion1 ics1