Vulnerability · Published May 17, 2022 · Assigned by icscert

CVE-2022-1118Rockwell Automation ISaGRAF Deserialization of Untrusted Data

High 8.6

In plain English

A high-severity unsafe deserialization in Connected Component Workbench from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.1% (higher than 96% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)11.1%top 4.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for Trusted Controllers)) do not limit the objects that can be deserialized. This allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in arbitrary code execution. This vulnerability requires user interaction to be successfully exploited

Affected products (as reported)

Vendor	Product	Versions
Rockwell Automation	Connected Component Workbench	All – through v13.00.00
Rockwell Automation	ISaGRAF Workbench	All v6.0 through v6.6.9
Rockwell Automation	Safety Instrumented Systems Workstation	All – through v1.2 (for Trusted Controllers)

Weakness: CWE-502 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-095-01 x_refsource_MISC