CODESYS V3 prone to Inadequate Encryption Stregth
CVE-2022-4048

7.7HIGH

Key Information:

Vendor

Codesys

Status
Codesys Development System V3
Vendor
CVE Published:
15 May 2023

What is CVE-2022-4048?

The CODESYS Development System versions prior to V3.5.18.40 exhibit a flaw in their encryption mechanisms, enabling an unauthenticated local attacker to gain unauthorized access. This vulnerability allows the attacker to manipulate the encrypted boot application code, posing a significant risk to system integrity and functionality. Immediate updates and security assessments are recommended to mitigate potential exploitation.

Affected Version(s)

CODESYS Development System V3 V0.0.0.0

References

https://customers.codesys.com/index.php?eID=dumpFile&t=f&...

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdelrahman Hassanien
Jos Wetzels
Forescout Technologies
.