CVE-2022-22515 : A remote, authenticated attacker could utilize the control program of the CODESY

A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.

Published 2022-04-07 19:15:08

Updated 2022-05-12 19:37:02

Source CERT VDE

View at NVD, CVE.org

Products affected by CVE-2022-22515

Codesys » Control Win Sl
Versions before (<) 3.5.18.0
cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:*
Matching versions
Codesys » Hmi Sl
Versions before (<) 3.5.18.0
cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:*
Matching versions
Codesys » Control For Raspberry Pi Sl
Versions before (<) 4.5.0.0
cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*
Matching versions
Codesys » Control For Empc-a/imx6 Sl
Versions before (<) 4.5.0.0
cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:*
Matching versions
Codesys » Control For Iot2000 Sl
Versions before (<) 4.5.0.0
cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*
Matching versions
Codesys » Control For Linux Sl
Versions before (<) 4.5.0.0
cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*
Matching versions
Codesys » Control For Pfc100 Sl
Versions before (<) 4.5.0.0
cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:*
Matching versions
Codesys » Control For Beaglebone Sl
Versions before (<) 4.5.0.0
cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:*
Matching versions
Codesys » Control For Pfc200 Sl
Versions before (<) 4.5.0.0
cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*
Matching versions
Codesys » Control Rte Sl
Versions before (<) 3.5.18.0
cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:*
Matching versions
Codesys » Control Rte Sl (for Beckhoff Cx)
Versions before (<) 3.5.18.0
cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\):*:*:*:*:*:*:*:*
Matching versions
Codesys » Development System
Versions from including (>=) 3.0 and before (<) 3.5.18.0
cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*
Matching versions
Codesys » Control Runtime System Toolkit
Versions before (<) 3.5.18.0
cpe:2.3:a:codesys:control_runtime_system_toolkit:*:*:*:*:*:*:*:*
Matching versions
Codesys » Embedded Target Visu Toolkit
Versions before (<) 3.5.18.0
cpe:2.3:a:codesys:embedded_target_visu_toolkit:*:*:*:*:*:*:*:*
Matching versions
Codesys » Remote Target Visu Toolkit
Versions before (<) 3.5.18.0
cpe:2.3:a:codesys:remote_target_visu_toolkit:*:*:*:*:*:*:*:*
Matching versions
Codesys » Control For Plcnext Sl
Versions before (<) 4.5.0.0
cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:*
Matching versions
Codesys » Control For Wago Touch Panels 600 Sl
Versions before (<) 4.5.0.0
cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:*
Matching versions
Codesys » Control For Beckhoff Cx9020
Versions before (<) 4.5.0.0
cpe:2.3:a:codesys:control_for_beckhoff_cx9020:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-22515

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 22 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-22515

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.9	MEDIUM	AV:N/AC:M/Au:S/C:P/I:P/A:N	6.8	4.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
8.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	2.8	5.2	CERT VDE
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None
8.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	2.8	5.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2022-22515

CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Assigned by: info@cert.vde.com (Primary)

References for CVE-2022-22515

https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17089&token=cc5041e24fc744a397a6f6e3b78200a40e6fcd53&download=

Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-22515

Products affected by CVE-2022-22515

Exploit prediction scoring system (EPSS) score for CVE-2022-22515

CVSS scores for CVE-2022-22515

CWE ids for CVE-2022-22515

References for CVE-2022-22515