Vulnerabilities for Connected components workbench (...) - CXSECURITY.COM

Vulnerabilities for 'Connected components workbench'

2022-03-23

CVE-2021-27471

CWE-22

The parsing mechanism that processes certain file types does not provide input sanitization for file paths. This may allow an attacker to craft malicious files that, when opened by Rockwell Automation Connected Components Workbench v12.00.00 and prior, can traverse the file system. If successfully exploited, an attacker could overwrite existing files and create additional files with the same permissions of the Connected Components Workbench software. User interaction is required for this exploit to be successful.

CVE-2021-27473

CWE-22

Rockwell Automation Connected Components Workbench v12.00.00 and prior does not sanitize paths specified within the .ccwarc archive file during extraction. This type of vulnerability is also commonly referred to as a Zip Slip. A local, authenticated attacker can create a malicious .ccwarc archive file that, when opened by Connected Components Workbench, will allow the attacker to gain the privileges of the software. If the software is running at SYSTEM level, the attacker will gain admin level privileges. User interaction is required for this exploit to be successful.

CVE-2021-27475

CWE-502

Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in remote code execution. This vulnerability requires user interaction to be successfully exploited.

2017-05-18

CVE-2017-5176

CWE-427

A DLL Hijack issue was discovered in Rockwell Automation Connected Components Workbench (CCW). The following versions are affected: Connected Components Workbench - Developer Edition, v9.01.00 and earlier: 9328-CCWDEVENE, 9328-CCWDEVZHE, 9328-CCWDEVFRE, 9328-CCWDEVITE, 9328-CCWDEVDEE, 9328-CCWDEVESE, and 9328-CCWDEVPTE; and Connected Components Workbench - Free Standard Edition (All Supported Languages), v9.01.00 and earlier. Certain DLLs included with versions of CCW software can be potentially hijacked to allow an attacker to gain rights to a victim's affected personal computer. Such access rights can be at the same or potentially higher level of privileges as the compromised user account, including and up to computer administrator privileges.

2014-11-13

CVE-2014-5424

Rockwell Automation Connected Components Workbench (CCW) before 7.00.00 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an invalid property value to an ActiveX control that was built with an outdated compiler.

>>> Vendor: Rockwellautomation 144 Products

Controllogix 1756-enbt/a ethernet/ ip bridge

Ab micrologix controller 1100

Ab micrologix controller 1400

1756-enbt series a

1756-enbt series a firmware

Eds hardware installation tool

Factorytalk diagnostics viewer

Ab micrologix controller

Plc-5 controller

Slc 500 controller

Controllogix controllers

Guardlogix controllers

Softlogix controllers

1794-aentr flex i/o ethernet/ip adapter

Compactlogix controllers

Compactlogix l32e controller

Compactlogix l35e controller

Flexlogix 1788-enbt adapter

Rslinx enterprise

Factorytalk services platform

Rslogix 5000 design and configuration software

Connected components workbench

Factorytalk view studio

Micrologix 1100 firmware

Micrologix 1400 firmware

1763-l16awa series a

1763-l16awa series b

1763-l16bbb series a

1763-l16bbb series b

1763-l16bwa series a

1763-l16bwa series b

1763-l16dwd series a

1763-l16dwd series b

Compactlogix controller 1769 firmware

Integrated architecture builder

Factorytalk energrymetrix

Rslogix 500 professional edition

Rslogix 500 standard edition

Rslogix 500 starter edition

Rslogix micro developer

Rslogix micro starter lite

1766-l32awa series b

1766-l32bxb series b

1766-l32awa series a

1766-l32bxb series a

1766-l32awaa series a

1766-l32bxba series b

1766-l32awaa series b

1766-l32bwaa series a

1766-l32bwa series b

1766-l32bwa series a

1766-l32bwaa series b

1766-l32bxba series a

Controllogix 5580 firmware

Compactlogix 5830 firmware

Panelview plus 6 700-1500 firmware

1763-l16dwd firmware

1763-l16bbb firmware

1763-l16bwa firmware

1763-l16awa firmware

Factorytalk alarms and events

1766-l32awa firmware

1766-l32awaa firmware

1766-l32bwa firmware

1766-l32bwaa firmware

1766-l32bxb firmware

1766-l32bxba firmware

Micrologix 1400 b firmware

Factorytalk activation

Allen-bradley l30erms firmware

1756-en2f series a firmware

1756-en2f series b firmware

1756-en2f series c firmware

1756-en2t series a firmware

1756-en2t series b firmware

1756-en2t series c firmware

1756-en2t series d firmware

See all Products for Vendor Rockwellautomation

Copyright 2024, cxsecurity.com