CVE-2022-22515
A component of the CODESYS Control runtime system allows read and write access to configuration files
- State
- Published
- Severity
- 8.1 High
- Published
- Apr 7, 2022
- Updated
- Sep 16, 2024
- Reserved
- Jan 3, 2022
Description
A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | CERTVDE |
Weaknesses
- CWE-668 Exposure of Resource to Wrong Sphere
Affected Products
| Product | Versions |
|---|---|
CODESYS Control RTE (SL)CODESYS |
|
CODESYS Control RTE (for Beckhoff CX) SLCODESYS |
|
CODESYS Control Win (SL)CODESYS |
|
CODESYS HMI (SL)CODESYS |
|
CODESYS Development System V3CODESYS |
|
CODESYS Control Runtime System ToolkitCODESYS |
|
CODESYS Embedded Target Visu ToolkitCODESYS |
|
CODESYS Remote Target Visu ToolkitCODESYS |
|
CODESYS Control for BeagleBone SLCODESYS |
|
CODESYS Control for Beckhoff CX9020 SLCODESYS |
|
CODESYS Control for emPC-A/iMX6 SLCODESYS |
|
CODESYS Control for IOT2000 SLCODESYS |
|
CODESYS Control for Linux SLCODESYS |
|
CODESYS Control for PFC100 SLCODESYS |
|
CODESYS Control for PFC200 SLCODESYS |
|
CODESYS Control for PLCnext SLCODESYS |
|
CODESYS Control for Raspberry Pi SLCODESYS |
|
CODESYS Control for WAGO Touch Panels 600 SLCODESYS |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.