CVE-2022-22513
published 2022-04-07CVE-2022-22513: An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash.
PriorityP432medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
1.00%
58.9th percentile
An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash.
Affected
41 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| codesys | codesys_control_for_beaglebone_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_beckhoff_cx9020_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_empc-a_imx6_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_iot2000_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_linux_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_pfc100_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_pfc200_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_plcnext_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_raspberry_pi_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_wago_touch_panels_600_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_rte | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | codesys_control_rte_sl | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | codesys_control_runtime_system_toolkit | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | codesys_control_win | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | codesys_development_system_v3 | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | codesys_edge_gateway_for_linux | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_edge_gateway_for_windows | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | codesys_embedded_target_visu_toolkit | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | codesys_gateway | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | codesys_hmi | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | codesys_remote_target_visu_toolkit | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | control_for_beaglebone_sl | < 4.5.0.0 | 4.5.0.0 |
| codesys | control_for_beckhoff_cx9020 | < 4.5.0.0 | 4.5.0.0 |
| codesys | control_for_empc-a_imx6_sl | < 4.5.0.0 | 4.5.0.0 |
| codesys | control_for_iot2000_sl | < 4.5.0.0 | 4.5.0.0 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
CODESYS in Festo Automation Suite
cisa_ics·2026-03-17
CODESYS in Festo Automation Suite
ICS Advisory
##
CODESYS in Festo Automation Suite
Release DateMarch 17, 2026
Alert CodeICSA-26-076-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
3. TECHNICAL DETAILS
The following versions of CODESYS in Festo Automation Suite are affected:
- FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.0) vers:all/*
- FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.5.16.10) vers:all/*
- FESTO Software Festo Automation Suite (2.8.0.137) installed with CODESYS Software CODESYS Development System (3.0) vers:all/*
- FESTO Software Festo Automation
CISA ICS
Festo Controller CECC-S,-LK,-D Family Firmware (Update A)
cisa_ics·2025-11-13
Festo Controller CECC-S,-LK,-D Family Firmware (Update A)
ICS Advisory
##
Festo Controller CECC-S,-LK,-D Family Firmware (Update A)
Last RevisedNovember 13, 2025
Alert CodeICSA-25-273-04
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Festo
- Equipment: Controller CECC-S,-LK,-D Family Firmware
- Vulnerabilities: Exposure of Resource to Wrong Sphere, Untrusted Pointer Dereference, NULL Pointer Dereference, Files or Directories Accessible to External Parties, Out-of-bounds Write, Improper Privilege Management, Incorrect Permission Assignment for Critical Resource, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Missing Release of Memory afte
GHSA
GHSA-4555-4gmg-wpcm: An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a c
ghsa_unreviewed·2022-04-08
CVE-2022-22513 [MEDIUM] CWE-476 GHSA-4555-4gmg-wpcm: An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a c
An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-04-07
Published