CVE Vulnerability

CVE-2022-27580

A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including 1.11.0 allows an attacker to craft malicious project files. Opening/importing such a malicious project file would execute arbitrary code with the privileges of the current user when opened or imported by the Safety Designer. This compromises confidentiality integrity and availability. For the attack to succeed a user must manually open a malicious project file.

7.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://sick.com/psirt Mitigation Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:sick:safety_designer:*:*:*:*:*:*:*:*
Information

Published : 2022-07-19 04:15

Updated : 2022-07-27 10:42

NVD link : CVE-2022-27580

Mitre link : CVE-2022-27580

Products Affected
No products.
CWE
CWE-502

Deserialization of Untrusted Data