CVE-2022-32143: fallo de gravedad alta en CODESYS PLCWinNT
CODESYS runtime system prone to directory acces
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 1.2%
In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller only if no level 1 password is configured on the controller or if remote attacker has previously successfully authenticated himself to the controller. A successful Attack may lead to a denial of service, change of local files, or drain of confidential Information. User interaction is not required
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVEs relacionadas — CODESYS PLCWinNT
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-32137HIGHCODESYS Runtime System prone to heap based buffer overflowEPSS 1.4%CVE-2022-32138HIGHCODESYS runtime system prone to denial of service due to Unexpected Sign ExtensionEPSS 1.2%CVE-2022-32142HIGHCODESYS runtime system prone to denial of service due to use of out of range pointerEPSS 1.1%CVE-2022-1965HIGHCODESYS runtime system prone to file deletion due to improper error handlingEPSS 1.1%CVE-2022-32140MEDIUMCODESYS runtime system prone to denial of service due to buffer copyEPSS 1.1%CVE-2022-32141MEDIUMCODESYS runtime system prone to denial of service due to buffer over readEPSS 1.0%