CVE-2022-31805

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-523

Affected software

Vendor	Product	Versions
CODESYS	CODESYS Development System	>= V2, < V2.3.9.69; >= V3, < V3.5.18.30
CODESYS	CODESYS Gateway Client	>= V2, < V2.3.9.38
CODESYS	CODESYS Gateway Server	>= V2, < V2.3.9.38
CODESYS	CODESYS Web server	>= V1, < V1.1.9.23
CODESYS	CODESYS SP Realtime NT	>= V2, < V2.3.7.30
CODESYS	CODESYS PLCWinNT	>= V2, < V2.4.7.57
CODESYS	CODESYS Runtime Toolkit 32 bit full	>= V2, < V2.4.7.57
CODESYS	CODESYS Edge Gateway for Windows	>= V3, < V3.5.18.30
CODESYS	CODESYS HMI (SL)	>= V3, < V3.5.18.30
CODESYS	CODESYS OPC DA Server SL	>= V3, < V3.5.18.30
CODESYS	CODESYS PLCHandler	>= V3, < V3.5.18.30
CODESYS	CODESYS Gateway	>= V3, < V3.5.18.30

References

Timeline

Published: Jun 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-318069.8In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no i CVE-2022-318075.5A vulnerability has been identified in Building X - Security Manager Edge Controller (ACC-AP) (All versions). Affected devices do not proper CVE-2022-318087.8A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V2.85.44), SiPass integrated ACC-AP (All versions <CVE-2022-31817.5An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior. A specifically malformed HTTP request coul CVE-2022-318107.5A vulnerability has been identified in SiPass integrated (All versions < V2.90.3.8). Affected server applications improperly check the size CVE-2022-318127.5A vulnerability has been identified in SiPass integrated (All versions < V2.95.3.18). Affected server applications contain an out of bounds CVE-2022-318139.8Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop CVE-2022-318149.8pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP H CVE-2022-31827.0Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers CVE-2022-318279.1MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php.CVE-2022-31839.8Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specific function does not sanitize the input provide CVE-2022-318309.1Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php.