CVE-2022-1118

Rockwell Automation ISaGRAF Deserialization of Untrusted Data

State: Published
Severity: 8.6 High
Published: May 17, 2022
Updated: Apr 16, 2025
Reserved: Mar 28, 2022

Description

Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for Trusted Controllers)) do not limit the objects that can be deserialized. This allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in arbitrary code execution. This vulnerability requires user interaction to be successfully exploited

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	icscert

Weaknesses

CWE-502 Deserialization of Untrusted Data

Affected Products

Product	Versions
Connected Component WorkbenchRockwell Automation	All through v13.00.00Affected
ISaGRAF WorkbenchRockwell Automation	All v6.0 through v6.6.9Affected
Safety Instrumented Systems WorkstationRockwell Automation	All through v1.2 (for Trusted Controllers)Affected

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-095-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.