### Critical Vulnerability Information #### 1. Executive Summary - **CVSS v3**: 8.6 - **Concern**: Low attack complexity - **Vendor**: Rockwell Automation - **Product**: ISaGRAF Workbench - **Vulnerabilities**: Deserialization of untrusted data, Path traversal #### 2. Risk Assessment - Successful exploitation of these vulnerabilities could lead to directory traversal, privilege escalation, and arbitrary code execution. #### 3. Technical Details ##### 3.1 Affected Products - ISaGRAF Workbench versions 6.0 through 6.6.9 ##### 3.2 Vulnerability Overview ###### 3.2.1 Path Traversal (CWE-22) - Vulnerability ID: CVE-2022-2463 - CVSS v3 Base Score: 6.1 - Description: Attackers can gain access to ISaGRAF Workbench software permissions by opening malicious files crafted to exploit this vulnerability. ###### 3.2.2 Path Traversal (CWE-22) - Vulnerability ID: CVE-2022-2464 - CVSS v3 Base Score: 7.7 - Description: Attackers can traverse the file system and create files with the same permissions as the ISaGRAF Workbench software by exploiting malicious files. ###### 3.2.3 Deserialization of Untrusted Data (CWE-502) - Vulnerability ID: CVE-2022-2465 - CVSS v3 Base Score: 8.6 - Description: ISaGRAF Workbench does not restrict deserializable objects, allowing attackers to trigger remote code execution via malicious serialized objects. #### 3.3 Background - **Critical Infrastructure Sector**: Critical Manufacturing - **Deployment Countries/Regions**: Global - **Company Headquarters Location**: United States #### 4. Mitigation Measures - Upgrade to version 6.6.10 or later. - Run ISaGRAF Workbench with user privileges instead of administrator rights. - Avoid opening untrusted .7z exchange files. - Use Microsoft AppLocker or similar application whitelisting tools. - Follow the principle of least privilege. - Implement additional defensive measures to minimize the risk of exploitation.