CVE-2022-1018

Description

When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality.

CVSS breakdown

CVSS 3.1

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected products

Rockwell Automation / Connected Component WorkbenchAll – 12
Rockwell Automation / ISaGRAFAll – 6.6.9
Rockwell Automation / Safety Instrumented Systems WorkstationAll – 1.1

References

VENDOR_ADVISORYhttps://www.cisa.gov/uscert/ics/advisories/icsa-22-088-01