« Back to list

CVE-2022-3156

Status: ModifiedHigh (7.8)—

A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software.  Users are granted elevated permissions on certain product services when the software is installed. Due to this misconfiguration, a malicious user could potentially achieve remote code execution on the targeted software.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Rockwellautomation — Studio 5000 Logix Emulate

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2022-3156",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-3156",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-10T20:05:43.136419Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "PSIRT@rockwellautomation.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "PSIRT@rockwellautomation.com",
      "affectedData": [
        {
          "vendor": "Rockwell Automation",
          "product": "Studio 5000 Logix Emulate",
          "versions": [
            {
              "status": "affected",
              "version": "20.011 ",
              "versionType": "Major",
              "lessThanOrEqual": "33.011"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2022-12-27T19:15:10.357",
  "references": [
    {
      "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137846",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "PSIRT@rockwellautomation.com"
    },
    {
      "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137846",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "PSIRT@rockwellautomation.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software.  Users are granted elevated permissions on certain product services when the software is installed. Due to \nthis misconfiguration, a malicious user could potentially achieve remote code execution on the targeted software.\n\n \n\n\n"
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de ejecución remota de código en el software Rockwell Automation Studio 5000 Logix Emulate. A los usuarios se les otorgan permisos elevados sobre ciertos servicios del producto cuando se instala el software. Debido a esta mala configuración, un usuario malintencionado podría lograr la ejecución remota de código en el software de destino."
    }
  ],
  "lastModified": "2026-06-17T04:58:58.447",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_emulate:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB9EB8A2-A2F2-45A4-923E-2E40BDF16F76",
              "versionEndExcluding": "34.00",
              "versionStartIncluding": "20.011"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "PSIRT@rockwellautomation.com"
}