Vulnerability · Published Jul 19, 2022 · Assigned by SICK AG

CVE-2022-27580

High 7.8

In plain English

A high-severity unsafe deserialization in SICK Safety Designer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS NVD)7.8High

Exploit odds (30 days)0.4%top 71.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including 1.11.0 allows an attacker to craft malicious project files. Opening/importing such a malicious project file would execute arbitrary code with the privileges of the current user when opened or imported by the Safety Designer. This compromises confidentiality integrity and availability. For the attack to succeed a user must manually open a malicious project file.

Affected products (as reported)

Vendor	Product	Versions
n/a	SICK Safety Designer	All versions up to and including 1.11.0

Weakness: CWE-502

References

https://sick.com/psirt x_refsource_MISC