Log in Start free

Vulnerability · Published May 15, 2023 · Assigned by CERTVDE

CVE-2022-22508CODESYS V3: Improper Input Validation

Medium 4.3

In plain English

A medium-severity improper input validation in CODESYS Control for BeagleBone SL from CODESYS V3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.7%top 45.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type.

Affected products (as reported)

VendorProductVersions
CODESYS V3 CODESYS Control RTE (SL) V0.0.0.0 – before V3.5.18.40
CODESYS V3 CODESYS Control RTE (for Beckhoff CX) SL V0.0.0.0 – before V3.5.18.40
CODESYS V3 CODESYS Control Win (SL) V0.0.0.0 – before V3.5.18.40
CODESYS V3 CODESYS HMI (SL) V0.0.0.0 – before V3.5.18.40
CODESYS V3 CODESYS Control Runtime System Toolkit V0.0.0.0 – before V3.5.18.40
CODESYS V3 CODESYS Control for BeagleBone SL V0.0.0.0 – before V4.7.0.0
CODESYS V3 CODESYS Control for emPC-A/iMX6 SL V0.0.0.0 – before V4.7.0.0
CODESYS V3 CODESYS Control for IOT2000 SL V0.0.0.0 – before V4.7.0.0
CODESYS V3 CODESYS Control for Linux SL V0.0.0.0 – before V4.7.0.0
CODESYS V3 CODESYS Control for PFC100 SL V0.0.0.0 – before V4.7.0.0
CODESYS V3 CODESYS Control for PFC200 SL V0.0.0.0 – before V4.7.0.0
CODESYS V3 CODESYS Control for PLCnext SL V0.0.0.0 – before V4.7.0.0
CODESYS V3 CODESYS Control for Raspberry Pi SL V0.0.0.0 – before V4.7.0.0
CODESYS V3 CODESYS Control for WAGO Touch Panels 600 SL V0.0.0.0 – before V4.7.0.0

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References