CVE-2022-1161 ICSA-22-090-05 Rockwell Automation Logix Controllers
Attackers can modify user program code in Rockwell Logix controllers by exploiting a separation between readable and executed code locations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1161?
CVE-2022-1161 is a critical code injection vulnerability in Rockwell Automation 1768 CompactLogix controllers, published on 11 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix Control systems. Studio 5000 Logix Designer writes user-readable program code to a separate location than the executed compiled code, allowing an attacker to change one and not the other.
Weakness: CWE-829
Which versions are affected by CVE-2022-1161?
It affects 24 products.
Products include Rockwellautomation Compact Guardlogix 5370 Firmware, Rockwellautomation Compact Guardlogix 5380 Firmware, Rockwellautomation Compactlogix 1768-L43 Firmware, Rockwellautomation Compactlogix 1768-L45 Firmware, Rockwellautomation Compactlogix 1769-L31 Firmware, Rockwellautomation Compactlogix 1769-L32c Firmware and 18 more.
How do I fix CVE-2022-1161?
No fix has been published for CVE-2022-1161 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-1161 being exploited?
There is no known exploitation of CVE-2022-1161 in the wild and no public exploit code.
Other vulnerabilities in Rockwell Automation 1768 CompactLogix controllers
Sources
Also known as GHSA-7mvq-cv2x-gv8r.