Vulnerability · Published Apr 7, 2022 · Assigned by CERTVDE
CVE-2022-22518A bug in the CODESYS V3 CmpUserMgr component fails to correctly apply a security policy.
Medium 6.5
In plain English
A medium-severity incorrect default permissions in CODESYS Control for BeagleBone SL from CODESYS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 50.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A bug in CmpUserMgr component can lead to only partially applied security policies. This can result in enabled, anonymous access to components part of the applied security policy.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CODESYS | CODESYS Control for BeagleBone SL | V4.5.0.0 – before V4.5.0.0 |
| CODESYS | CODESYS Control for Beckhoff CX9020 SL | V4.5.0.0 – before V4.5.0.0 |
| CODESYS | CODESYS Control for emPC-A/iMX6 SL | V4.5.0.0 – before V4.5.0.0 |
| CODESYS | CODESYS Control for IOT2000 SL | V4.5.0.0 – before V4.5.0.0 |
| CODESYS | CODESYS Control for Linux SL | V4.5.0.0 – before V4.5.0.0 |
| CODESYS | CODESYS Control for PFC100 SL | V4.5.0.0 – before V4.5.0.0 |
| CODESYS | CODESYS Control for PFC200 SL | V4.5.0.0 – before V4.5.0.0 |
| CODESYS | CODESYS Control for Raspberry Pi SL | V4.5.0.0 – before V4.5.0.0 |
| CODESYS | CODESYS Control for WAGO Touch Panels 600 SL | V4.5.0.0 – before V4.5.0.0 |
| CODESYS | CODESYS Control Runtime System Toolkit | V3.5.18.0 – before V3.5.18.0 |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N