CVE-2022-1018: Rockwellautomation Connected Components Workbench

Medium severity, CVSS 5.5. EPSS: 2.2% chance of exploitation in the next 30 days.

When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality.

Affected products

• Rockwellautomation Connected Components Workbench: up to and including 12.0
• Rockwellautomation Isagraf: up to and including 6.6.9
• Rockwellautomation Safety Instrumented Systems Workstation: up to and including 1.1

Published 2022-04-01. Last modified 2026-06-17.