Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for Trusted Controllers)) do not limit the objects that can be deserialized. This allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in arbitrary code execution. This vulnerability requires user interaction to be successfully exploited
References
| Link | Resource |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-22-095-01 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
|
History
26 May 2022, 01:39
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.cisa.gov/uscert/ics/advisories/icsa-22-095-01 - Third Party Advisory, US Government Resource | |
| First Time |
Rockwellautomation connected Component Workbench
Rockwellautomation Rockwellautomation safety Instrumented Systems Workstation Rockwellautomation isagraf Workbench |
|
| CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 7.8 |
| CPE | cpe:2.3:a:rockwellautomation:isagraf_workbench:*:*:*:*:*:*:*:* cpe:2.3:a:rockwellautomation:safety_instrumented_systems_workstation:*:*:*:*:*:*:*:* cpe:2.3:a:rockwellautomation:connected_component_workbench:*:*:*:*:*:*:*:* |
17 May 2022, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-05-17 20:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-1118
Mitre link : CVE-2022-1118
CVE.ORG link : CVE-2022-1118
JSON object : View
Products Affected
rockwellautomation
- isagraf_workbench
- safety_instrumented_systems_workstation
- connected_component_workbench
CWE
CWE-502
Deserialization of Untrusted Data