Insecure default settings in CODESYS Runtime Toolkit 32 bit full and CODESYS PLCWinNT
CVE-2022-31806

9.8CRITICAL

Key Information:

Vendor

Codesys

Status
Codesys Plcwinnt
Codesys Runtime Toolkit 32 Bit Full
Vendor
CVE Published:
24 June 2022

What is CVE-2022-31806?

In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller.

Affected Version(s)

CODESYS PLCWinNT V2

CODESYS Runtime Toolkit 32 bit full V2

References

https://customers.codesys.com/index.php?eID=dumpFile&t=f&...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.