CVE-2022-22508

CODESYS V3: Improper Input Validation

Medium4.3EPSS 0.73%

Published: 15 May 2023
Updated: 23 Jan 2025
Reserved: 3 Jan 2022
Assigned by: CERTVDE

Description

Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type.

Scores

CVSS scores of CVE-2022-22508, by who scored it
Scored by	CVSS	Score	Vector
CERTVDECNA (assigner)	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVDNVD · Modified	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS (exploitation in 30 days): 0.73% · top 46% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

CWE-20 Improper Input Validation (opens in a new tab)All about CWE-20 and its CVEs

Affected products

CODESYS V3 · CODESYS Control RTE (SL)
- affected V0.0.0.0 – < V3.5.18.40
CODESYS V3 · CODESYS Control RTE (for Beckhoff CX) SL
- affected V0.0.0.0 – < V3.5.18.40
CODESYS V3 · CODESYS Control Win (SL)
- affected V0.0.0.0 – < V3.5.18.40
CODESYS V3 · CODESYS HMI (SL)
- affected V0.0.0.0 – < V3.5.18.40
CODESYS V3 · CODESYS Control Runtime System Toolkit
- affected V0.0.0.0 – < V3.5.18.40
CODESYS V3 · CODESYS Control for BeagleBone SL
- affected V0.0.0.0 – < V4.7.0.0
CODESYS V3 · CODESYS Control for emPC-A/iMX6 SL
- affected V0.0.0.0 – < V4.7.0.0
CODESYS V3 · CODESYS Control for IOT2000 SL
- affected V0.0.0.0 – < V4.7.0.0
CODESYS V3 · CODESYS Control for Linux SL
- affected V0.0.0.0 – < V4.7.0.0
CODESYS V3 · CODESYS Control for PFC100 SL
- affected V0.0.0.0 – < V4.7.0.0
CODESYS V3 · CODESYS Control for PFC200 SL
- affected V0.0.0.0 – < V4.7.0.0
CODESYS V3 · CODESYS Control for PLCnext SL
- affected V0.0.0.0 – < V4.7.0.0
CODESYS V3 · CODESYS Control for Raspberry Pi SL
- affected V0.0.0.0 – < V4.7.0.0
CODESYS V3 · CODESYS Control for WAGO Touch Panels 600 SL
- affected V0.0.0.0 – < V4.7.0.0

References (1)

https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17351&token=a7c02b2825fea2bcaf80c1a8e62097d72ec90f1a&download= (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-22508](https://trackcve.app/badge/CVE-2022-22508.svg)](https://trackcve.app/cve/CVE-2022-22508)

Record last updated 23 Jan 2025, 19:24 UTC.