Sign-up

ID

VAR-202212-2066


CVE

CVE-2022-3156


TITLE

Rockwell Automation Studio 5000 Logix Designer Access Control Error Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2024-13564

DESCRIPTION

A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software.   Users are granted elevated permissions on certain product services when the software is installed.  Due to this misconfiguration, a malicious user could potentially achieve remote code execution on the targeted software. It is used to build programs for PLCs. No detailed vulnerability details are currently provided

Trust: 1.53

sources: NVD: CVE-2022-3156 // CNVD: CNVD-2024-13564 // VULHUB: VHN-430798

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-13564

AFFECTED PRODUCTS

vendor:rockwellautomationmodel:studio 5000 logix emulatescope:ltversion:34.00

Trust: 1.0

vendor:rockwellautomationmodel:studio 5000 logix emulatescope:gteversion:20.011

Trust: 1.0

vendor:rockwellmodel:automation rockwell automation studio logix designerscope:eqversion:5000v.20-33

Trust: 0.6

sources: CNVD: CNVD-2024-13564 // NVD: CVE-2022-3156

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-3156
value: HIGH

Trust: 1.0

PSIRT@rockwellautomation.com: CVE-2022-3156
value: HIGH

Trust: 1.0

CNVD: CNVD-2024-13564
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202212-3803
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-13564
severity: MEDIUM
baseScore: 6.8
vectorString: AV:L/AC:L/AU:S/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.1
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-3156
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 2.0

sources: CNVD: CNVD-2024-13564 // CNNVD: CNNVD-202212-3803 // NVD: CVE-2022-3156 // NVD: CVE-2022-3156

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.1

sources: VULHUB: VHN-430798 // NVD: CVE-2022-3156

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202212-3803

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-202212-3803

PATCH

title:Patch for Rockwell Automation Studio 5000 Logix Designer Access Control Error Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/534226

Trust: 0.6

title:Rockwell Automation Studio 5000 Logix Designer Remediation measures for authorization problem vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=220326

Trust: 0.6

sources: CNVD: CNVD-2024-13564 // CNNVD: CNNVD-202212-3803

EXTERNAL IDS

db:NVDid:CVE-2022-3156

Trust: 2.3

db:CNVDid:CNVD-2024-13564

Trust: 0.6

db:AUSCERTid:ESB-2022.6662

Trust: 0.6

db:ICS CERTid:ICSA-22-356-02

Trust: 0.6

db:CNNVDid:CNNVD-202212-3803

Trust: 0.6

db:VULHUBid:VHN-430798

Trust: 0.1

sources: CNVD: CNVD-2024-13564 // VULHUB: VHN-430798 // CNNVD: CNNVD-202212-3803 // NVD: CVE-2022-3156

REFERENCES

url:https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137846

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2022-3156

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-356-02

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.6662

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-3156/

Trust: 0.6

sources: CNVD: CNVD-2024-13564 // VULHUB: VHN-430798 // CNNVD: CNNVD-202212-3803 // NVD: CVE-2022-3156

CREDITS

Rockwell Automation reported this vulnerability to CISA.

Trust: 0.6

sources: CNNVD: CNNVD-202212-3803

SOURCES

db:CNVDid:CNVD-2024-13564
db:VULHUBid:VHN-430798
db:CNNVDid:CNNVD-202212-3803
db:NVDid:CVE-2022-3156

LAST UPDATE DATE

2025-03-22T23:40:00.510000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-13564date:2025-03-13T00:00:00
db:VULHUBid:VHN-430798date:2023-01-06T00:00:00
db:CNNVDid:CNNVD-202212-3803date:2023-01-09T00:00:00
db:NVDid:CVE-2022-3156date:2023-11-07T03:50:51.807

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-13564date:2024-03-15T00:00:00
db:VULHUBid:VHN-430798date:2022-12-27T00:00:00
db:CNNVDid:CNNVD-202212-3803date:2022-12-22T00:00:00
db:NVDid:CVE-2022-3156date:2022-12-27T19:15:10.357