CVE-2022-1159 Rockwell Automation Studio 5000 Logix Designer Code Injection

2022-04-0122:17:51

CWE-94

icscert

www.cve.org

rockwell automation

logix designer

code injection

vulnerable

administrator access

CVSS3

7.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

29.2%

JSON

Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio 5000 Logix Designer could inject controller code undetectable to a user.

CNA Affected

[
  {
    "product": "Studio 5000 Logix Designer",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "status": "affected",
        "version": "All"
      }
    ]
  }
]