What’s Vulnerable › Vulnerabilities

CVE-2022-1018: ICSA-22-088-01 Rockwell Automation ISaGRAF

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-01 · updated 2026-06-17
• Weakness: CWE-611

Description

When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality.

Affected products

• Rockwell Automation Connected Components Workbench: through 12.0
• Rockwell Automation ISaGRAF: through 6.6.9
• Rockwell Automation Safety Instrumented Systems Workstation: through 1.1

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-01
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-01

Get alerted when CVE-2022-1018 or the next vulnerability affects your stack