CVE-2022-1118 : Security Advisory and Response
Learn about CVE-2022-1118, a high-severity vulnerability in Rockwell Automation products allowing the creation of malicious objects for arbitrary code execution. Find mitigation steps and system protection advice.
This article provides an overview of CVE-2022-1118, a vulnerability affecting Rockwell Automation products.
Understanding CVE-2022-1118
CVE-2022-1118 is a vulnerability that impacts Rockwell Automation products, specifically Connected Component Workbench, ISaGRAF Workbench, and Safety Instrumented Systems Workstation.
What is CVE-2022-1118?
The vulnerability in Connected Component Workbench, ISaGRAF Workbench, and Safety Instrumented Systems Workstation allows attackers to create malicious serialized objects that can lead to arbitrary code execution if opened by a local user in Connected Components Workbench. The exploitation of this vulnerability requires user interaction.
The Impact of CVE-2022-1118
With a CVSS base score of 8.6, CVE-2022-1118 has a high severity level. It poses a significant risk to confidentiality, integrity, and availability, with a changed scope requiring no privileges for exploitation.
Technical Details of CVE-2022-1118
This section outlines the vulnerability description, affected systems, and exploitation mechanism.
Vulnerability Description
The vulnerability arises from a lack of object deserialization limitation, allowing for the creation of malicious objects.
Affected Systems and Versions
Rockwell Automation products affected include Connected Component Workbench (up to v13.00.00), ISaGRAF Workbench (v6.0 to v6.6.9), and Safety Instrumented Systems Workstation (up to v1.2 for Trusted Controllers).
Exploitation Mechanism
The exploitation of this vulnerability requires the user to interact with the crafted malicious object in Connected Components Workbench.
Mitigation and Prevention
To address CVE-2022-1118, it is crucial to take immediate steps and implement long-term security practices.
Immediate Steps to Take
Users are advised to be cautious with opening objects in Connected Components Workbench and to only interact with trusted sources.
Long-Term Security Practices
Implementing proper input validation mechanisms and conducting regular security audits can enhance overall system security.
Patching and Updates
Vendor patches for affected versions should be promptly applied to mitigate the risk of exploitation and protect system integrity.