CVE-2022-22508
published 2023-05-15CVE-2022-22508: Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type.
PriorityP420medium4.3CVSS 3.1
AVNACLPRLUINSUCNINAL
EPSS
0.73%
50.0th percentile
Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| codesys | control_for_beaglebone_sl | < 4.7.0.0 | 4.7.0.0 |
| codesys | control_for_empc-a_imx6_sl | < 4.7.0.0 | 4.7.0.0 |
| codesys | control_for_iot2000_sl | < 4.7.0.0 | 4.7.0.0 |
| codesys | control_for_linux_sl | < 4.7.0.0 | 4.7.0.0 |
| codesys | control_for_pfc100_sl | < 4.7.0.0 | 4.7.0.0 |
| codesys | control_for_pfc200_sl | < 4.7.0.0 | 4.7.0.0 |
| codesys | control_for_plcnext_sl | < 4.7.0.0 | 4.7.0.0 |
| codesys | control_for_raspberry_pi_sl | < 4.7.0.0 | 4.7.0.0 |
| codesys | control_for_wago_touch_panels_600_sl | < 4.7.0.0 | 4.7.0.0 |
| codesys | control_rte | < 3.5.18.40 | 3.5.18.40 |
| codesys | control_rte_sl | < 3.5.18.40 | 3.5.18.40 |
| codesys | control_runtime_system_toolkit | < 3.5.18.40 | 3.5.18.40 |
| codesys | control_win | < 3.5.18.40 | 3.5.18.40 |
| codesys | hmi | < 3.5.18.40 | 3.5.18.40 |
| codesys_v3 | codesys_control_for_beaglebone_sl | >= V0.0.0.0 < V4.7.0.0 | V4.7.0.0 |
| codesys_v3 | codesys_control_for_empc-a_imx6_sl | >= V0.0.0.0 < V4.7.0.0 | V4.7.0.0 |
| codesys_v3 | codesys_control_for_iot2000_sl | >= V0.0.0.0 < V4.7.0.0 | V4.7.0.0 |
| codesys_v3 | codesys_control_for_linux_sl | >= V0.0.0.0 < V4.7.0.0 | V4.7.0.0 |
| codesys_v3 | codesys_control_for_pfc100_sl | >= V0.0.0.0 < V4.7.0.0 | V4.7.0.0 |
| codesys_v3 | codesys_control_for_pfc200_sl | >= V0.0.0.0 < V4.7.0.0 | V4.7.0.0 |
| codesys_v3 | codesys_control_for_plcnext_sl | >= V0.0.0.0 < V4.7.0.0 | V4.7.0.0 |
| codesys_v3 | codesys_control_for_raspberry_pi_sl | >= V0.0.0.0 < V4.7.0.0 | V4.7.0.0 |
| codesys_v3 | codesys_control_for_wago_touch_panels_600_sl | >= V0.0.0.0 < V4.7.0.0 | V4.7.0.0 |
| codesys_v3 | codesys_control_rte | >= V0.0.0.0 < V3.5.18.40 | V3.5.18.40 |
| codesys_v3 | codesys_control_rte_sl | >= V0.0.0.0 < V3.5.18.40 | V3.5.18.40 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
CODESYS in Festo Automation Suite
cisa_ics·2026-03-17
CODESYS in Festo Automation Suite
ICS Advisory
##
CODESYS in Festo Automation Suite
Release DateMarch 17, 2026
Alert CodeICSA-26-076-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
3. TECHNICAL DETAILS
The following versions of CODESYS in Festo Automation Suite are affected:
- FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.0) vers:all/*
- FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.5.16.10) vers:all/*
- FESTO Software Festo Automation Suite (2.8.0.137) installed with CODESYS Software CODESYS Development System (3.0) vers:all/*
- FESTO Software Festo Automation
GHSA
GHSA-r25h-c4pw-fm98: Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a speci
ghsa_unreviewed·2023-05-15
CVE-2022-22508 [MEDIUM] CWE-20 GHSA-r25h-c4pw-fm98: Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a speci
Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type.
No detection rules found.
No public exploits indexed.
2023-05-15
Published