CVE-2022-1118
High
Description
Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for Trusted Controllers)) do not limit the objects that can be deserialized. This allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in arbitrary code execution. This vulnerability requires user interaction to be successfully exploited
SeverityHigh
CVSS8.6
Exploit probability—
ProductRockwellautomation Connected Component Workbench
PublishedMay 17, 2022
First seenMay 17, 2022
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rockwellautomation connected_component_workbench | v ≤ 13.00.00 | — |
| rockwellautomation isagraf_workbench | 6.0 ≤ v ≤ 6.6.9 | — |
| rockwellautomation safety_instrumented_systems_workstation | v ≤ 1.2 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.