Vulnerability · Published Jul 19, 2022 · Assigned by SICK AG

CVE-2022-27579

High 7.8

In plain English

A high-severity unsafe deserialization in SICK Flexi Soft Designer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS NVD)7.8High

Exploit odds (30 days)0.4%top 71.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and including 1.9.4 SP1 allows an attacker to craft malicious project files. Opening/importing such a malicious project file would execute arbitrary code with the privileges of the current user when opened or imported by the Flexi Soft Designer. This compromises confidentiality integrity and availability. For the attack to succeed a user must manually open a malicious project file.

Affected products (as reported)

Vendor	Product	Versions
n/a	SICK Flexi Soft Designer	All versions up to and including 1.9.4 SP1

Weakness: CWE-502

References

https://sick.com/psirt x_refsource_MISC