Vulnerability · Published Apr 1, 2022 · Assigned by icscert
CVE-2022-1018ICSA-22-088-01 Rockwell Automation ISaGRAF
Medium 5.5
In plain English
A medium-severity XML external entity in Connected Component Workbench from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)2.2%top 17.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | Connected Component Workbench | All – before 12 |
| Rockwell Automation | ISaGRAF | All – before 6.6.9 |
| Rockwell Automation | Safety Instrumented Systems Workstation | All – before 1.1 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-01 x_refsource_MISC