Vulnerability · Published Jun 24, 2022 · Assigned by CERTVDE
CVE-2022-31805Insecure transmission of credentials
High 7.5
In plain English
A high-severity security flaw in CODESYS Development System from CODESYS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.0%top 35.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CODESYS | CODESYS Development System | V2 – before V2.3.9.69V3 – before V3.5.18.30 |
| CODESYS | CODESYS Gateway Client | V2 – before V2.3.9.38 |
| CODESYS | CODESYS Gateway Server | V2 – before V2.3.9.38 |
| CODESYS | CODESYS Web server | V1 – before V1.1.9.23 |
| CODESYS | CODESYS SP Realtime NT | V2 – before V2.3.7.30 |
| CODESYS | CODESYS PLCWinNT | V2 – before V2.4.7.57 |
| CODESYS | CODESYS Runtime Toolkit 32 bit full | V2 – before V2.4.7.57 |
| CODESYS | CODESYS Edge Gateway for Windows | V3 – before V3.5.18.30 |
| CODESYS | CODESYS HMI (SL) | V3 – before V3.5.18.30 |
| CODESYS | CODESYS OPC DA Server SL | V3 – before V3.5.18.30 |
| CODESYS | CODESYS PLCHandler | V3 – before V3.5.18.30 |
| CODESYS | CODESYS Gateway | V3 – before V3.5.18.30 |
Weakness: CWE-523 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N