CVE-2022-22517

CWE-334CWE-3303 documents3 sources
Severity
7.5HIGH
EPSS
0.4%
top 36.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
43
Codesys Codesys Control FOR Beaglebone SLCodesys Codesys Control FOR Beckhoff Cx9020 SLCodesys Codesys Control FOR Empc-a/imx6 SL+40 more
Timeline
PublishedApr 7
Latest updateApr 8

Description

An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages34 packages

▶CVEListV5codesys/codesys_remote_target_visu_toolkitV3.5.18.0 — V3.5.18.0
▶NVDcodesys/hmi_sl< 3.5.18.0
▶NVDcodesys/control< 4.5.0.0
▶NVDcodesys/gateway< 3.5.18.0

🔴Vulnerability Details

2
GHSA
GHSA-95jh-v98h-7gww: An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting↗2022-04-08
▶
CVEList
Communication Components in multiple CODESYS products vulnerable to communication channel disruption↗2022-04-07
▶
CVE-2022-22517 (HIGH CVSS 7.5) | An unauthenticated | cvebase.io