CVE-2022-1018

MEDIUM

Rockwell Automation Connected Components Workbench < 12.0 - XML External Entity Injection via Malicious Solution File

Title source: llm

Description

When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality.

References (1)

Core 1

Core References

Mitigation, Patch, Third Party Advisory, US Government Resource x_refsource_misc

https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-01

Scores

CVSS v3 5.5

EPSS 0.0914

EPSS Percentile 92.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-611

Status published

Products (3)

rockwellautomation/connected_components_workbench < 12.0

rockwellautomation/isagraf < 6.6.9

rockwellautomation/safety_instrumented_systems_workstation < 1.1

Published Apr 01, 2022

Tracked Since Feb 18, 2026