CVE-2022-1018
mediumPriorität · verfolgen · 23EPSS 0.022 · 82. PerzentilEURUUSEPSS · bewertet 2026-10-28
When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenConnected Component Workbenchcisa_csaf_ot
Safety Instrumented Systems Workstation: Update to v1.2
https://compatibility.rockwellautomation.com/Pages/MultiProductFindDownloads.aspx?crumb=112&mode=3&refSoft=1&versions=60852 - BehobenISaGRAF Workbenchcisa_csaf_ot
Safety Instrumented Systems Workstation: Update to v1.2
https://compatibility.rockwellautomation.com/Pages/MultiProductFindDownloads.aspx?crumb=112&mode=3&refSoft=1&versions=60852 - BehobenSafety Instrumented Systems Workstationcisa_csaf_ot
Safety Instrumented Systems Workstation: Update to v1.2
https://compatibility.rockwellautomation.com/Pages/MultiProductFindDownloads.aspx?crumb=112&mode=3&refSoft=1&versions=60852 - MitigationConnected Component Workbenchcisa_csaf_ot
Do not open untrusted files with Connected Component Workbench, ISaGRAF, SISW. Employ training and awareness programs to educate users on the warning signs of a phishing or social engineering attack.
- MitigationISaGRAF Workbenchcisa_csaf_ot
Do not open untrusted files with Connected Component Workbench, ISaGRAF, SISW. Employ training and awareness programs to educate users on the warning signs of a phishing or social engineering attack.
- MitigationSafety Instrumented Systems Workstationcisa_csaf_ot
Do not open untrusted files with Connected Component Workbench, ISaGRAF, SISW. Employ training and awareness programs to educate users on the warning signs of a phishing or social engineering attack.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (17)
Betroffene Produkte und Versionsbereiche.
- rockwellautomation connected components workbench≤ 12.0nvdUScpe:2.3:a:rockwellautomation:connected_components_workbench:*:*:*:*:*:*:*:*
- rockwellautomation safety instrumented systems workstation≤ 1.1nvdUScpe:2.3:o:rockwellautomation:safety_instrumented_systems_workstation:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-22-088-01Rockwell Automation ISaGRAF2022-03-29icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to pass local file data to a remote web server, leading to loss of confidentiality.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2022-1018/cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-22-088-01cnnvd
- https://www.auscert.org.au/bulletins/ESB-2022.1331cnnvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-01cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2022033008cnnvd
- https://www.rockwellautomation.com/en-in/trust-center/security-advisories/advisory.PN1588.htmlPatchcnnvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-01enisa_euvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-01MitigationPatchThird Party AdvisoryUS Government Resourcenvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan