CVE-2022-2465highCWE-502

CVE-2022-2465: high-severity vulnerability in Rockwell Automation ISaGRAF Workbench

ISaGRAF Workbench Deserialization of Untrusted Data CWE-502

Published · Updated

Follow this CVE+ Monitor ISaGRAF Workbench

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.3%
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Deserialization of Untrusted Data vulnerability. ISaGRAF Workbench does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in ISaGRAF Workbench, may result in remote code execution. This vulnerability requires user interaction to be successfully exploited.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
Rockwell Automation · ISaGRAF Workbench
Related CVEs — Rockwell Automation ISaGRAF Workbench

In the same product, most dangerous first.

CVE-2022-1118HIGHRockwell Automation ISaGRAF Deserialization of Untrusted DataEPSS 11.1%CVE-2022-2463MEDIUMISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22EPSS 2.8%CVE-2022-2464HIGHISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22EPSS 0.3%