CVE-2022-1018 ICSA-22-088-01 Rockwell Automation ISaGRAF
An attacker can exploit an XML external entity vulnerability in Rockwell Automation ISaGRAF to read local files and exfiltrate data to a remote server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-1018?
CVE-2022-1018 is a medium-severity vulnerability in Rockwell Automation Connected Component Workbench, published on 1 Apr 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality.
Weakness: CWE-611
Which versions are affected by CVE-2022-1018?
It affects 3 products.
Products include Rockwellautomation Connected Components Workbench, Rockwellautomation Isagraf, Rockwellautomation Safety Instrumented Systems Workstation.
How do I fix CVE-2022-1018?
No fix has been published for CVE-2022-1018 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-1018 being exploited?
There is no known exploitation of CVE-2022-1018 in the wild and no public exploit code.
Other vulnerabilities in Rockwell Automation Connected Component Workbench
- CVE-2021-27475 Rockwell Automation Connected Components Workbench Deserialization of Untrusted Data
- CVE-2021-27471 Rockwell Automation Connected Components Workbench Path Traversal
- CVE-2014-5424 Code injection in n/a
- CVE-2017-5176 Other in Rockwell Automation Connected Components Workbench
- CVE-2021-27473 Rockwell Automation Connected Components Workbench Improper Input Validation
Sources
Also known as GHSA-558x-9fxp-vfqf.