High ICSA-22-095-01 1 CVE

Rockwell Automation ISaGRAF

Published Apr 5, 2022 · Updated Apr 5, 2022

Vendor: Rockwell Automation Product: Connected Component Workbench Product: ISaGRAF Workbench Product: Safety Instrumented Systems Workstation

Summary

Successful exploitation of this vulnerability could allow arbitrary code execution.

Vulnerabilities 1

High 8.6

CVE-2022-1118 EPSS 11%

Rockwell Automation ISaGRAF Deserialization of Untrusted Data

Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for Trusted Controllers)) do not limit the objects that can be deserialized. This allows attackers to cra…

Rockwell Automation ISaGRAF Workbench Safety Instrumented Systems Workstation Connected Component Workbench ICS / OT

May 17, 2022

Revision history

2022-04-05 #1
ICSA-22-095-01 Rockwell Automation ISaGRAF

References

ICS Advisory ICSA-22-095-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-095-01
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B