CVE-2022-1118highexplotación observadaCWE-502

CVE-2022-1118: fallo de gravedad alta en Rockwell Automation ISaGRAF Workbench

Rockwell Automation ISaGRAF Deserialization of Untrusted Data

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear ISaGRAF Workbench+ Monitorear Connected Component Workbench

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

48Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Actcvss 8.6epss 11%
de la publicación al arma
Publicada en NVD17 may
VulnCheck+350d
Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for Trusted Controllers)) do not limit the objects that can be deserialized. This allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in arbitrary code execution. This vulnerability requires user interaction to be successfully exploited
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Productos afectados
Rockwell Automation · Connected Component WorkbenchRockwell Automation · ISaGRAF WorkbenchRockwell Automation · Safety Instrumented Systems Workstation
CVEs relacionadas — Rockwell Automation ISaGRAF Workbench

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-2463MEDIUMISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22EPSS 2.8%CVE-2022-1018MEDIUMICSA-22-088-01 Rockwell Automation ISaGRAFEPSS 2.2%CVE-2022-2465HIGHISaGRAF Workbench Deserialization of Untrusted Data CWE-502EPSS 0.3%CVE-2022-2464HIGHISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22EPSS 0.3%