Rockwell Automation ISaGRAF

🗓️ 05 Apr 2022 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 44 Views

Rockwell Automation ISaGRAF vulnerability with deserialization of untrusted data can allow arbitrary code execution. Affected products include Connected Component Workbench v13.00.00, ISaGRAF Workbench v6.0 to v6.6.9, and Safety Instrumented Systems Workstation v1.2. Mitigations include updating to v20.00 or later, running Connected Components Workbench as a User, not as an Administrator, using Microsoft AppLocker, and following the least-privilege user principle

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2022-1118	18 May 202200:28	–	circl
CNNVD	Rockwell Automation Connected Components Workbench 代码问题漏洞	5 Apr 202200:00	–	cnnvd
CVE	CVE-2022-1118	17 May 202219:47	–	cve
Cvelist	CVE-2022-1118 Rockwell Automation ISaGRAF Deserialization of Untrusted Data	17 May 202219:47	–	cvelist
NVD	CVE-2022-1118	17 May 202220:15	–	nvd
OSV	CVE-2022-1118	17 May 202220:15	–	osv
Prion	Remote code execution	17 May 202220:15	–	prion
RedhatCVE	CVE-2022-1118	5 Feb 202522:59	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2022-1118	2 May 202300:00	–	vulncheck_kev
Vulnrichment	CVE-2022-1118 Rockwell Automation ISaGRAF Deserialization of Untrusted Data	17 May 202219:47	–	vulnrichment

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-095-01.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-22-095-01
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

05 Apr 2022 00:00Current

8.2High risk

Vulners AI Score8.2

CVSS 26.8

CVSS 3.17.8 - 8.6

EPSS0.22092

SSVC