CVE-2022-1118: high-severity vulnerability in Rockwell Automation ISaGRAF Workbench
Rockwell Automation ISaGRAF Deserialization of Untrusted Data
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Actcvss 8.6epss 11%
from disclosure to weapon
Published on NVDMay 17
VulnCheck+350d
Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for Trusted Controllers)) do not limit the objects that can be deserialized. This allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in arbitrary code execution. This vulnerability requires user interaction to be successfully exploited
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
Rockwell Automation · Connected Component WorkbenchRockwell Automation · ISaGRAF WorkbenchRockwell Automation · Safety Instrumented Systems WorkstationRelated CVEs — Rockwell Automation ISaGRAF Workbench
In the same product, most dangerous first.
CVE-2022-2463MEDIUMISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22EPSS 2.8%CVE-2022-1018MEDIUMICSA-22-088-01 Rockwell Automation ISaGRAFEPSS 2.2%CVE-2022-2465HIGHISaGRAF Workbench Deserialization of Untrusted Data CWE-502EPSS 0.3%CVE-2022-2464HIGHISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22EPSS 0.3%