CVE-2022-47391: high-severity vulnerability in CODESYS Control for BeagleBone SL
CODESYS: Multiple products prone to Improper Input Validation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
CODESYS products don't properly check incoming data, allowing attackers to make the software crash by reading from invalid memory locations. This can take the system offline.
The vulnerability stems from improper input validation (CWE-20) in multiple CODESYS product versions, enabling unauthenticated remote attackers to trigger denial of service by forcing the application to read from invalid memory addresses. The attack requires network access to affected products with no prior authentication.
In the same product, most dangerous first.