CVE-2022-1159

Rockwell Automation Studio 5000 Logix Designer Code Injection

Description

Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio 5000 Logix Designer could inject controller code undetectable to a user.

Remediation

Workaround:

  • Rockwell Automation recommends users of the affected hardware and software take risk mitigation steps listed below. Users are encouraged, when possible, to combine this guidance with the general security guidelines for a comprehensive defense-in-depth strategy. There is no direct mitigation for this vulnerability in the Logix Designer application. However, a detection method is available to determine if the user program residing in the controller is identical to what was downloaded. This user program verification can be done by the following: On-demand using the Logix Designer application Compare Tool v9 or later Scheduled using FactoryTalk AssetCentre v12 or later user program verification (Available Fall 2022) To leverage these detection capabilities, users are directed to upgrade to: Studio 5000 v34 software. or later Corresponding versions of Logix 5580, 5380, 5480, GuardLogix 5580 and Compact GuardLogix 5380 controller firmware. One of the following compare tools Logix Designer application Compare Tool v9 or later – installed with Studio 5000 Logix Designer FactoryTalk AssetCentre v12 or later software (Available Fall 2022) This user program comparison must be performed on an uncompromised workstation.

Category

7.7
CVSS
Severity: High
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.04%
Third-Party Advisory cisa.gov
Affected: Rockwell Automation Studio 5000 Logix Designer
Published at:
Updated at:

References

Link Tags
https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-07 us government resource third party advisory mitigation

Frequently Asked Questions

What is the severity of CVE-2022-1159?
CVE-2022-1159 has been scored as a high severity vulnerability.
How to fix CVE-2022-1159?
As a workaround for remediating CVE-2022-1159: Rockwell Automation recommends users of the affected hardware and software take risk mitigation steps listed below. Users are encouraged, when possible, to combine this guidance with the general security guidelines for a comprehensive defense-in-depth strategy. There is no direct mitigation for this vulnerability in the Logix Designer application. However, a detection method is available to determine if the user program residing in the controller is identical to what was downloaded. This user program verification can be done by the following: On-demand using the Logix Designer application Compare Tool v9 or later Scheduled using FactoryTalk AssetCentre v12 or later user program verification (Available Fall 2022) To leverage these detection capabilities, users are directed to upgrade to: Studio 5000 v34 software. or later Corresponding versions of Logix 5580, 5380, 5480, GuardLogix 5580 and Compact GuardLogix 5380 controller firmware. One of the following compare tools Logix Designer application Compare Tool v9 or later – installed with Studio 5000 Logix Designer FactoryTalk AssetCentre v12 or later software (Available Fall 2022) This user program comparison must be performed on an uncompromised workstation.
Is CVE-2022-1159 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2022-1159 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-1159?
CVE-2022-1159 affects Rockwell Automation Studio 5000 Logix Designer.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.