CVE-2022-31806: In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or…

PriorityP351critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.15%

63.0th percentile

In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
codesys	codesys_plcwinnt	>= V2 < V2.4.7.57	V2.4.7.57
codesys	codesys_runtime_toolkit_32_bit_full	>= V2 < V2.4.7.57	V2.4.7.57
codesys	plcwinnt	< 2.4.7.57	2.4.7.57
codesys	runtime_toolkit	< 2.4.7.57	2.4.7.57

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.