Riskcovery

CVE-2022-31805

Insecure transmission of credentials

State
Published
Severity
7.5 High
Published
Jun 24, 2022
Updated
Sep 16, 2024
Reserved
May 30, 2022

Read the record on cve.org

Description

In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCERTVDE

Weaknesses

  • CWE-523 Unprotected Transport of Credentials

Affected Products

ProductVersions
CODESYS Development SystemCODESYS
  • V2 to before V2.3.9.69Affected
  • V3 to before V3.5.18.30Affected
CODESYS Gateway ClientCODESYS
  • V2 to before V2.3.9.38Affected
CODESYS Gateway ServerCODESYS
  • V2 to before V2.3.9.38Affected
CODESYS Web serverCODESYS
  • V1 to before V1.1.9.23Affected
CODESYS SP Realtime NTCODESYS
  • V2 to before V2.3.7.30Affected
CODESYS PLCWinNTCODESYS
  • V2 to before V2.4.7.57Affected
CODESYS Runtime Toolkit 32 bit fullCODESYS
  • V2 to before V2.4.7.57Affected
CODESYS Edge Gateway for WindowsCODESYS
  • V3 to before V3.5.18.30Affected
CODESYS HMI (SL)CODESYS
  • V3 to before V3.5.18.30Affected
CODESYS OPC DA Server SLCODESYS
  • V3 to before V3.5.18.30Affected
CODESYS PLCHandlerCODESYS
  • V3 to before V3.5.18.30Affected
CODESYS GatewayCODESYS
  • V3 to before V3.5.18.30Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.