CVE-2022-1159

Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio 5000 Logix Designer could inject controller code undetectable to a user.
References
Link Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-07 Mitigation Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:rockwellautomation:controllogix_5580_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:rockwellautomation:controllogix_5580:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:rockwellautomation:guardlogix_5580_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:rockwellautomation:guardlogix_5580:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:rockwellautomation:compactlogix_5380_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:rockwellautomation:compactlogix_5380:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:rockwellautomation:compactlogix_5480_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:rockwellautomation:compactlogix_5480:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:rockwellautomation:compact_guardlogix_5380_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:rockwellautomation:compact_guardlogix_5380:-:*:*:*:*:*:*:*

History

08 Apr 2022, 20:12

Type Values Removed Values Added
CPE cpe:2.3:h:rockwellautomation:guardlogix_5580:-:*:*:*:*:*:*:*
cpe:2.3:h:rockwellautomation:controllogix_5580:-:*:*:*:*:*:*:*
cpe:2.3:o:rockwellautomation:compactlogix_5380_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:rockwellautomation:compactlogix_5480_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:rockwellautomation:compactlogix_5480:-:*:*:*:*:*:*:*
cpe:2.3:o:rockwellautomation:compact_guardlogix_5380_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:rockwellautomation:guardlogix_5580_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:rockwellautomation:controllogix_5580_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:rockwellautomation:compact_guardlogix_5380:-:*:*:*:*:*:*:*
cpe:2.3:h:rockwellautomation:compactlogix_5380:-:*:*:*:*:*:*:*
CWE CWE-94
References (CONFIRM) https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-07 - (CONFIRM) https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-07 - Mitigation, Third Party Advisory, US Government Resource
CVSS v2 : unknown
v3 : unknown
v2 : 6.5
v3 : 7.2

01 Apr 2022, 23:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-04-01 23:15

Updated : 2024-02-04 22:29


NVD link : CVE-2022-1159

Mitre link : CVE-2022-1159

CVE.ORG link : CVE-2022-1159


JSON object : View

Products Affected

rockwellautomation

  • controllogix_5580
  • compactlogix_5380_firmware
  • guardlogix_5580
  • compact_guardlogix_5380
  • guardlogix_5580_firmware
  • compact_guardlogix_5380_firmware
  • controllogix_5580_firmware
  • compactlogix_5480_firmware
  • compactlogix_5480
  • compactlogix_5380
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')