CVE-2022-1118highexploração observadaCWE-502

CVE-2022-1118: falha de alta gravidade em Rockwell Automation ISaGRAF Workbench

Rockwell Automation ISaGRAF Deserialization of Untrusted Data

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ISaGRAF Workbench+ Monitorar Connected Component Workbench

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

48Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck.

ssvc Actcvss 8.6epss 11%
da publicação à arma
Publicada no NVD17 de mai.
VulnCheck+350d
Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for Trusted Controllers)) do not limit the objects that can be deserialized. This allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in arbitrary code execution. This vulnerability requires user interaction to be successfully exploited
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
Rockwell Automation · Connected Component WorkbenchRockwell Automation · ISaGRAF WorkbenchRockwell Automation · Safety Instrumented Systems Workstation
CVEs relacionadas — Rockwell Automation ISaGRAF Workbench

No mesmo produto, das mais perigosas para as menos.

CVE-2022-2463MEDIUMISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22EPSS 2.8%CVE-2022-1018MEDIUMICSA-22-088-01 Rockwell Automation ISaGRAFEPSS 2.2%CVE-2022-2465HIGHISaGRAF Workbench Deserialization of Untrusted Data CWE-502EPSS 0.3%CVE-2022-2464HIGHISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22EPSS 0.3%