CVE-2022-47383

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
CODESYSCODESYS Control RTE (SL)>= V0.0.0.0, < V3.5.19.0
CODESYSCODESYS Control RTE (for Beckhoff CX) SL>= V0.0.0.0, < V3.5.19.0
CODESYSCODESYS Control Win (SL)>= V0.0.0.0, < V3.5.19.0
CODESYSCODESYS Control Runtime System Toolkit>= V0.0.0.0, < V3.5.19.0
CODESYSCODESYS Safety SIL2 Runtime Toolkit>= V0.0.0.0, < V3.5.19.0
CODESYSCODESYS Safety SIL2 PSP>= V0.0.0.0, < V3.5.19.0
CODESYSCODESYS HMI (SL)>= V0.0.0.0, < V3.5.19.0
CODESYSCODESYS Development System V3>= V0.0.0.0, < V3.5.19.0
CODESYSCODESYS Control for BeagleBone SL>= V0.0.0.0, < V4.8.0.0
CODESYSCODESYS Control for emPC-A/iMX6 SL>= V0.0.0.0, < V4.8.0.0
CODESYSCODESYS Control for IOT2000 SL>= V0.0.0.0, < V4.8.0.0
CODESYSCODESYS Control for Linux SL>= V0.0.0.0, < V4.8.0.0
CODESYSCODESYS Control for PFC100 SL>= V0.0.0.0, < V4.8.0.0
CODESYSCODESYS Control for PFC200 SL>= V0.0.0.0, < V4.8.0.0
CODESYSCODESYS Control for PLCnext SL>= V0.0.0.0, < V4.8.0.0
CODESYSCODESYS Control for Raspberry Pi SL>= V0.0.0.0, < V4.8.0.0
CODESYSCODESYS Control for WAGO Touch Panels 600 SL>= V0.0.0.0, < V4.8.0.0

References

Timeline

Published
May 15, 2023
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-473848.8An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS prCVE-2022-473858.8An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS pCVE-2022-473868.8An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS pCVE-2022-473878.8An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS prCVE-2022-473888.8An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS pCVE-2022-473898.8An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS pCVE-2022-47399.8A vulnerability classified as critical was found in SourceCodester School Dormitory Management System 1.0. Affected by this vulnerability isCVE-2022-473908.8An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS pCVE-2022-473917.5In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to readCVE-2022-473926.5An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiplCVE-2022-473936.5An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiplCVE-2022-473958.1Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery
CVE-2022-47383: High severity, CVSS 8.8 | Vulnix