CVE-2022-31805

Published: Jun 24, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD (Secondary)

Description

In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.

Affected (10)

Products: Codesys: Development System, Edge Gateway, Gateway, Hmi Sl, Opc Server, Plchandler, Plcwinnt, Runtime Toolkit, Sp Realtime Nt, Web Server

10 products

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Codesys Development System	Before 2.3.9.69
Codesys Edge Gateway	Before 3.5.18.30
Codesys Gateway	Before 2.3.9.38
Codesys Hmi Sl	Before 3.5.18.30
Codesys Opc Server	Before 3.5.18.30
Codesys Plchandler	Before 3.5.18.30
Codesys Plcwinnt	Before 2.4.7.57
Codesys Runtime Toolkit	Before 2.4.7.57
Codesys Sp Realtime Nt	Before 2.3.7.30
Codesys Web Server	Before 1.1.9.23

Related CWEs

CWE-523

Unprotected Transport of Credentials

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

References (2)

https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17140&token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c&download=

Source: info@cert.vde.com

Vendor Advisory

https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17140&token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c&download=

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.