CVE-2022-22519
published 2022-04-07CVE-2022-22519: A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.40%
69.8th percentile
A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| codesys | codesys_control_for_beaglebone_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_beckhoff_cx9020_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_empc-a_imx6_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_iot2000_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_linux_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_pfc100_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_pfc200_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_plcnext_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_raspberry_pi_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_for_wago_touch_panels_600_sl | >= V4.5.0.0 < V4.5.0.0 | V4.5.0.0 |
| codesys | codesys_control_rte | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | codesys_control_rte_sl | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | codesys_control_runtime_system_toolkit | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | codesys_control_win | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | codesys_embedded_target_visu_toolkit | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | codesys_hmi | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | codesys_remote_target_visu_toolkit | >= V3.5.18.0 < V3.5.18.0 | V3.5.18.0 |
| codesys | control_for_beaglebone_sl | < 4.5.0.0 | 4.5.0.0 |
| codesys | control_for_beckhoff_cx9020 | < 4.5.0.0 | 4.5.0.0 |
| codesys | control_for_empc-a_imx6_sl | < 4.5.0.0 | 4.5.0.0 |
| codesys | control_for_iot2000_sl | < 4.5.0.0 | 4.5.0.0 |
| codesys | control_for_linux_sl | < 4.5.0.0 | 4.5.0.0 |
| codesys | control_for_pfc100_sl | < 4.5.0.0 | 4.5.0.0 |
| codesys | control_for_pfc200_sl | < 4.5.0.0 | 4.5.0.0 |
| codesys | control_for_plcnext_sl | < 4.5.0.0 | 4.5.0.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
CODESYS in Festo Automation Suite
cisa_ics·2026-03-17
CODESYS in Festo Automation Suite
ICS Advisory
##
CODESYS in Festo Automation Suite
Release DateMarch 17, 2026
Alert CodeICSA-26-076-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
3. TECHNICAL DETAILS
The following versions of CODESYS in Festo Automation Suite are affected:
- FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.0) vers:all/*
- FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.5.16.10) vers:all/*
- FESTO Software Festo Automation Suite (2.8.0.137) installed with CODESYS Software CODESYS Development System (3.0) vers:all/*
- FESTO Software Festo Automation
CISA ICS
Festo Controller CECC-S,-LK,-D Family Firmware (Update A)
cisa_ics·2025-11-13
Festo Controller CECC-S,-LK,-D Family Firmware (Update A)
ICS Advisory
##
Festo Controller CECC-S,-LK,-D Family Firmware (Update A)
Last RevisedNovember 13, 2025
Alert CodeICSA-25-273-04
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Festo
- Equipment: Controller CECC-S,-LK,-D Family Firmware
- Vulnerabilities: Exposure of Resource to Wrong Sphere, Untrusted Pointer Dereference, NULL Pointer Dereference, Files or Directories Accessible to External Parties, Out-of-bounds Write, Improper Privilege Management, Incorrect Permission Assignment for Critical Resource, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Missing Release of Memory afte
GHSA
GHSA-cx43-qj46-j7wr: A remote, authenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver a
ghsa_unreviewed·2022-04-08
CVE-2022-22519 [MEDIUM] CWE-125 GHSA-cx43-qj46-j7wr: A remote, authenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver a
A remote, authenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver and the CODESYS Control runtime system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-04-07
Published