Medium severity5.5NVD Advisory· Published Apr 1, 2022· Updated Jun 17, 2026

CVE-2022-1018

Description

When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality.

Affected products

Rockwellautomation/Connected Components Workbench2 versions
cpe:2.3:a:rockwellautomation:connected_components_workbench:*:*:*:*:-:*:*:*+ 1 more
- cpe:2.3:a:rockwellautomation:connected_components_workbench:*:*:*:*:-:*:*:*range: <=12.0
- (no CPE)range: All
Rockwellautomation/Isagraf
cpe:2.3:a:rockwellautomation:isagraf:*:*:*:*:*:*:*:*
Range: <=6.6.9
Rockwellautomation/Safety Instrumented Systems Workstation
cpe:2.3:o:rockwellautomation:safety_instrumented_systems_workstation:*:*:*:*:*:*:*:*
Range: <=1.1
Rockwell Automation/ISaGRAFv5
Range: All
Rockwell Automation/Safety Instrumented Systems Workstationv5
Range: All

Patches

Vulnerability mechanics

References

www.cisa.gov/uscert/ics/advisories/icsa-22-088-01nvdMitigationPatchThird Party AdvisoryUS Government Resource

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000