Riskcovery

CVE-2022-4224

CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3

State
Published
Severity
8.8 High
Published
Mar 23, 2023
Updated
May 29, 2026
Reserved
Nov 30, 2022

Read the record on cve.org

Description

In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCERTVDE

Weaknesses

  • CWE-1188 Insecure Default Initialization of Resource

Affected Products

ProductVersions
Control RTE (SL)CODESYS
  • 3.0.0.0 to before 3.5.19.0Affected
Control RTE (for Beckhoff CX) SLCODESYS
  • 3.0.0.0 to before 3.5.19.0Affected
Control Win (SL)CODESYS
  • 3.0.0.0 to before 3.5.19.0Affected
Runtime ToolkitCODESYS
  • 3.0.0.0 to before 3.5.19.0Affected
Safety SIL2 Runtime ToolkitCODESYS
  • 3.0.0.0 to before 3.5.19.0Affected
Safety SIL2 PSPCODESYS
  • 3.0.0.0 to before 3.5.19.0Affected
HMI (SL)CODESYS
  • 3.0.0.0 to before 3.5.19.0Affected
Development System V3CODESYS
  • 3.0.0.0 to before 3.5.19.0Affected
Control for BeagleBone SLCODESYS
  • 3.0.0.0 to before 4.8.0.0Affected
Control for emPC-A/iMX6 SLCODESYS
  • 3.0.0.0 to before 4.8.0.0Affected
Control for IOT2000 SLCODESYS
  • 3.0.0.0 to before 4.8.0.0Affected
Control for Linux SLCODESYS
  • 3.0.0.0 to before 4.8.0.0Affected
Control for PFC100 SLCODESYS
  • 3.0.0.0 to before 4.8.0.0Affected
Control for PFC200 SLCODESYS
  • 3.0.0.0 to before 4.8.0.0Affected
Control for PLCnext SLCODESYS
  • 3.0.0.0 to before 4.8.0.0Affected
Control for Raspberry Pi SLCODESYS
  • 3.0.0.0 to before 4.8.0.0Affected
Control for WAGO Touch Panels 600 SLCODESYS
  • 3.0.0.0 to before 4.8.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.