CVE-2022-2463mediumCWE-22

CVE-2022-2463: medium-severity vulnerability in Rockwell Automation ISaGRAF Workbench

ISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22

Published · Updated

Follow this CVE+ Monitor ISaGRAF Workbench

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 2.8%
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. A crafted malicious .7z exchange file may allow an attacker to gain the privileges of the ISaGRAF Workbench software when opened. If the software is running at the SYSTEM level, then the attacker will gain admin level privileges. User interaction is required for this exploit to be successful.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Affected products
Rockwell Automation · ISaGRAF Workbench
Related CVEs — Rockwell Automation ISaGRAF Workbench

In the same product, most dangerous first.

CVE-2022-1118HIGHRockwell Automation ISaGRAF Deserialization of Untrusted DataEPSS 11.1%CVE-2022-2465HIGHISaGRAF Workbench Deserialization of Untrusted Data CWE-502EPSS 0.3%CVE-2022-2464HIGHISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22EPSS 0.3%