Vulnerability Details : CVE-2022-4224
In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device.
Vulnerability category: Denial of service
Products affected by CVE-2022-4224
- cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\):*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:safety_sil2:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:*:*
- cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:*
- Codesys » Control For Wago Touch Panels 600 SlVersions from including (>=) 3.0 and before (<) 4.8.0.0cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-4224
0.24%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 62 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-4224
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
CERT VDE | |
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST | 2024-02-01 |
CWE ids for CVE-2022-4224
-
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.Assigned by:
- info@cert.vde.com (Secondary)
- nvd@nist.gov (Primary)
-
The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.Assigned by:
- info@cert.vde.com (Primary)
- nvd@nist.gov (Secondary)
References for CVE-2022-4224
Jump to