GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-31805 (GCVE-0-2022-31805)

Vulnerability from cvelistv5 – Published: 2022-06-24 07:46 – Updated: 2024-09-16 18:55
VLAI
Title
Insecure transmission of credentials
Summary
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-523 - Unprotected Transport of Credentials
Assigner
References
Impacted products
Vendor Product Version CPE status
CODESYS CODESYS Development System Affected: V2 , < V2.3.9.69 (custom)
Affected: V3 , < V3.5.18.30 (custom)
guessed Create a notification for this product.
CODESYS CODESYS Gateway Client Affected: V2 , < V2.3.9.38 (custom)
guessed Create a notification for this product.
CODESYS CODESYS Gateway Server Affected: V2 , < V2.3.9.38 (custom)
guessed Create a notification for this product.
CODESYS CODESYS Web server Affected: V1 , < V1.1.9.23 (custom)
guessed Create a notification for this product.
CODESYS CODESYS SP Realtime NT Affected: V2 , < V2.3.7.30 (custom)
guessed Create a notification for this product.
CODESYS CODESYS PLCWinNT Affected: V2 , < V2.4.7.57 (custom)
guessed Create a notification for this product.
CODESYS CODESYS Runtime Toolkit 32 bit full Affected: V2 , < V2.4.7.57 (custom)
guessed Create a notification for this product.
CODESYS CODESYS Edge Gateway for Windows Affected: V3 , < V3.5.18.30 (custom)
guessed Create a notification for this product.
CODESYS CODESYS HMI (SL) Affected: V3 , < V3.5.18.30 (custom)
guessed Create a notification for this product.
CODESYS CODESYS OPC DA Server SL Affected: V3 , < V3.5.18.30 (custom)
guessed Create a notification for this product.
CODESYS CODESYS PLCHandler Affected: V3 , < V3.5.18.30 (custom)
guessed Create a notification for this product.
CODESYS CODESYS Gateway Affected: V3 , < V3.5.18.30 (custom)
guessed Create a notification for this product.
Date Public
2022-06-22 22:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:01.086Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download="
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Development System",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.3.9.69",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            },
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Gateway Client",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.3.9.38",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Gateway Server",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.3.9.38",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Web server",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V1.1.9.23",
              "status": "affected",
              "version": "V1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS SP Realtime NT",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.3.7.30",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS PLCWinNT",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.4.7.57",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Runtime Toolkit 32 bit full",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.4.7.57",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Edge Gateway for Windows",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS HMI (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS OPC DA Server SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS PLCHandler",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Gateway",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2022-06-22T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.\u003c/p\u003e"
            }
          ],
          "value": "In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-523",
              "description": "CWE-523 Unprotected Transport of Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-09T12:54:39.506Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download="
        }
      ],
      "source": {
        "defect": [
          "CERT@VDE#",
          "64140"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Insecure transmission of credentials",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "info@cert.vde.com",
          "DATE_PUBLIC": "2022-06-23T10:00:00.000Z",
          "ID": "CVE-2022-31805",
          "STATE": "PUBLIC",
          "TITLE": "Insecure transmission of credentials"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CODESYS Development System",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.3.9.69"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Gateway Client",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.3.9.38"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Gateway Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.3.9.38"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Web server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V1",
                            "version_value": "V1.1.9.23"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS SP Realtime NT",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.3.7.30"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS PLCWinNT",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.4.7.57"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Runtime Toolkit 32 bit full",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.4.7.57"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Edge Gateway for Windows",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS HMI (SL)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS OPC DA Server SL",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS PLCHandler",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Gateway",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "CODESYS"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-523 Unprotected Transport of Credentials"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download=",
              "refsource": "CONFIRM",
              "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download="
            }
          ]
        },
        "source": {
          "defect": [
            "CERT@VDE#",
            "64140"
          ],
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2022-31805",
    "datePublished": "2022-06-24T07:46:15.076Z",
    "dateReserved": "2022-05-30T00:00:00.000Z",
    "dateUpdated": "2024-09-16T18:55:26.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-31805",
      "date": "2026-09-16",
      "epss": "0.01021",
      "percentile": "0.61694"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.3.9.69\", \"matchCriteriaId\": \"85D06342-38A2-4E95-BE56-08D54271E41F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:edge_gateway:*:*:*:*:*:windows:*:*\", \"versionEndExcluding\": \"3.5.18.30\", \"matchCriteriaId\": \"EC5C6832-F0B3-46DF-8047-22A2544D937C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:gateway:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.3.9.38\", \"matchCriteriaId\": \"6B9AE405-A0E5-48FF-9E8C-1A323D296445\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.5.18.30\", \"matchCriteriaId\": \"F23A1B9F-97EE-4E4C-AAB9-511B4A3ED98C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:opc_server:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.5.18.30\", \"matchCriteriaId\": \"46CDFB44-9702-4978-B577-9D07DF3D04B0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:plchandler:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.5.18.30\", \"matchCriteriaId\": \"4932F620-43F8-4F3F-80AE-CD603BF05962\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:plcwinnt:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.4.7.57\", \"matchCriteriaId\": \"6887DEB0-5C13-4D7B-86E6-504D8CBB2A0D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:x86:*\", \"versionEndExcluding\": \"2.4.7.57\", \"matchCriteriaId\": \"5A605019-68F5-4C21-96BD-C300DECAA3D8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:sp_realtime_nt:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.3.7.30\", \"matchCriteriaId\": \"14F1D049-7DF2-453A-9D5A-7FCBCAD465E3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:web_server:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.1.9.23\", \"matchCriteriaId\": \"971AF379-F2B6-4791-B153-718517CA3E62\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.\"}, {\"lang\": \"es\", \"value\": \"En CODESYS Development System, varios componentes en diversos versiones transmiten las contrase\\u00f1as para la comunicaci\\u00f3n entre clientes y servidores sin protecci\\u00f3n\"}]",
      "id": "CVE-2022-31805",
      "lastModified": "2024-11-21T07:05:22.057",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"info@cert.vde.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}, {\"source\": \"nvd@nist.gov\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:N/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2022-06-24T08:15:07.590",
      "references": "[{\"url\": \"https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download=\", \"source\": \"info@cert.vde.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download=\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "info@cert.vde.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"info@cert.vde.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-523\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-31805\",\"sourceIdentifier\":\"info@cert.vde.com\",\"published\":\"2022-06-24T08:15:07.590\",\"lastModified\":\"2026-06-17T04:46:20.640\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.\"},{\"lang\":\"es\",\"value\":\"En CODESYS Development System, varios componentes en diversos versiones transmiten las contrase\u00f1as para la comunicaci\u00f3n entre clientes y servidores sin protecci\u00f3n\"}],\"affected\":[{\"source\":\"info@cert.vde.com\",\"affectedData\":[{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Development System\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V2\",\"lessThan\":\"V2.3.9.69\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"V3\",\"lessThan\":\"V3.5.18.30\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Gateway Client\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V2\",\"lessThan\":\"V2.3.9.38\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Gateway Server\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V2\",\"lessThan\":\"V2.3.9.38\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Web server\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V1\",\"lessThan\":\"V1.1.9.23\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS SP Realtime NT\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V2\",\"lessThan\":\"V2.3.7.30\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS PLCWinNT\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V2\",\"lessThan\":\"V2.4.7.57\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Runtime Toolkit 32 bit full\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V2\",\"lessThan\":\"V2.4.7.57\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Edge Gateway for Windows\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V3\",\"lessThan\":\"V3.5.18.30\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS HMI (SL)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V3\",\"lessThan\":\"V3.5.18.30\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS OPC DA Server SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V3\",\"lessThan\":\"V3.5.18.30\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS PLCHandler\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V3\",\"lessThan\":\"V3.5.18.30\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"CODESYS Gateway\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"V3\",\"lessThan\":\"V3.5.18.30\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:N/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-523\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.3.9.69\",\"matchCriteriaId\":\"85D06342-38A2-4E95-BE56-08D54271E41F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:edge_gateway:*:*:*:*:*:windows:*:*\",\"versionEndExcluding\":\"3.5.18.30\",\"matchCriteriaId\":\"EC5C6832-F0B3-46DF-8047-22A2544D937C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:gateway:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.3.9.38\",\"matchCriteriaId\":\"6B9AE405-A0E5-48FF-9E8C-1A323D296445\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.5.18.30\",\"matchCriteriaId\":\"F23A1B9F-97EE-4E4C-AAB9-511B4A3ED98C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:opc_server:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.5.18.30\",\"matchCriteriaId\":\"46CDFB44-9702-4978-B577-9D07DF3D04B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:plchandler:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.5.18.30\",\"matchCriteriaId\":\"4932F620-43F8-4F3F-80AE-CD603BF05962\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:plcwinnt:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.4.7.57\",\"matchCriteriaId\":\"6887DEB0-5C13-4D7B-86E6-504D8CBB2A0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:x86:*\",\"versionEndExcluding\":\"2.4.7.57\",\"matchCriteriaId\":\"5A605019-68F5-4C21-96BD-C300DECAA3D8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:sp_realtime_nt:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.3.7.30\",\"matchCriteriaId\":\"14F1D049-7DF2-453A-9D5A-7FCBCAD465E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:web_server:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.1.9.23\",\"matchCriteriaId\":\"971AF379-F2B6-4791-B153-718517CA3E62\"}]}]}],\"references\":[{\"url\":\"https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download=\",\"source\":\"info@cert.vde.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download=\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-03-27T12:21:56+00:00",
      "cve": "CVE-2022-31805",
      "id": "CVE-2022-31805",
      "initial_release_date": "2022-06-22T22:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Insecure transmission of credentials",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-31805.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.