PT-2022-4140 · Rockwell Automation · Isagraf Workbench

Mashav Sapir · Published 2022-07-21 · Updated 2022-08-27 · CVE-2022-2463

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9

Description The issue is related to a Path Traversal vulnerability. A crafted malicious .7z exchange file may allow an attacker to gain the privileges of the ISaGRAF Workbench software when opened. If the software is running at the SYSTEM level, then the attacker will gain admin level privileges. User interaction is required for this exploit to be successful. The vulnerability is also described as being related to incorrect restriction of a directory path with limited access, which may allow an attacker to elevate their privileges using a specially crafted malicious file in the .7z format.

Recommendations For Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9, consider disabling the opening of .7z exchange files until a patch is available to prevent potential exploitation. Restrict access to the software when it is running at the SYSTEM level to minimize the risk of gaining admin level privileges. Avoid using the software with user interaction that may lead to opening crafted malicious files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2022-04983

CVE-2022-2463

Affected Products

Isagraf Workbench

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-2463 · Security Note
• https://bdu.fstec.ru/vul/2022-04983 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-202-03 · Patch
• https://osv.dev/vulnerability/CVE-2022-2463 · Vendor Advisory
• https://t.me/cibsecurity/48806 · Telegram Post