CVE-2022-22514
Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS.
- State
- Published
- Severity
- 7.1 High
- Published
- Apr 7, 2022
- Updated
- Sep 17, 2024
- Reserved
- Jan 3, 2022
Description
An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to local overwriting of memory in the CmpTraceMgr, whereby the attacker can neither gain the values read internally nor control the values to be written. If invalid memory is accessed, this results in a crash.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H | CERTVDE |
Weaknesses
- CWE-822 Untrusted Pointer Dereference
Affected Products
| Product | Versions |
|---|---|
CODESYS Control RTE (SL)CODESYS |
|
CODESYS Control RTE (for Beckhoff CX) SLCODESYS |
|
CODESYS Control Win (SL)CODESYS |
|
CODESYS GatewayCODESYS |
|
CODESYS Edge Gateway for WindowsCODESYS |
|
CODESYS HMI (SL)CODESYS |
|
CODESYS Development System V3CODESYS |
|
CODESYS Control Runtime System ToolkitCODESYS |
|
CODESYS Embedded Target Visu ToolkitCODESYS |
|
CODESYS Remote Target Visu ToolkitCODESYS |
|
CODESYS Control for BeagleBone SLCODESYS |
|
CODESYS Control for Beckhoff CX9020 SLCODESYS |
|
CODESYS Control for emPC-A/iMX6 SLCODESYS |
|
CODESYS Control for IOT2000 SLCODESYS |
|
CODESYS Control for Linux SLCODESYS |
|
CODESYS Control for PFC100 SLCODESYS |
|
CODESYS Control for PFC200 SLCODESYS |
|
CODESYS Control for PLCnext SLCODESYS |
|
CODESYS Control for Raspberry Pi SLCODESYS |
|
CODESYS Control for WAGO Touch Panels 600 SLCODESYS |
|
CODESYS Edge Gateway for LinuxCODESYS |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.