Vulnerability · Published Apr 7, 2022 · Assigned by CERTVDE
CVE-2022-22516CODESYS driver SysDrv3S allows SYSTEM users on Microsoft Windows to read and write in restricted memory space.
High 7.8
In plain English
A high-severity incorrect permission assignment in CODESYS Control RTE (for Beckhoff CX) SL from CODESYS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 81.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CODESYS | CODESYS Control RTE (SL) | V3.5.18.0 – before V3.5.18.0 |
| CODESYS | CODESYS Control RTE (for Beckhoff CX) SL | V3.5.18.0 – before V3.5.18.0 |
| CODESYS | CODESYS Control Win (SL) | V3.5.18.0 – before V3.5.18.0 |
| CODESYS | CODESYS Development System V3 | V3.5.18.0 – before V3.5.18.0 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H