Description
When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Rockwell Automation | Connected Component Workbench | All – < 12 | 12 |
| Rockwell Automation | ISaGRAF | All – < 6.6.9 | 6.6.9 |
| Rockwell Automation | Safety Instrumented Systems Workstation | All – < 1.1 | 1.1 |
Advisories 1
- ICSA-22-088-01 Rockwell Automation ISaGRAF CISA ICS & IT advisories · Mar 29, 2022