PT-2022-20946 · 3S Smart Software Solutions · Codesys V2 Plcwinnt+1

Avinash Hanwate · Published 2022-06-24 · Updated 2022-12-01 · CVE-2022-31806

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CODESYS V2 PLCWinNT and Runtime Toolkit 32 versions prior to V2.4.7.57

Description The issue concerns password protection not being enabled by default. In cases where no password is set at the controller, there is no information or prompt to enable password protection at login.

Recommendations For versions prior to V2.4.7.57, update to version V2.4.7.57 or later to enable password protection by default. As a temporary workaround, consider manually enabling password protection for the controller to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2022-31806

Affected Products

Codesys V2 Plcwinnt

Codesys V2 Runtime Toolkit 32

References · 6

• https://osv.dev/vulnerability/CVE-2022-31806 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31806 · Security Note
• https://t.me/true_secator/3768 · Telegram Post
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17140&token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c&download= · Note
• https://t.me/cybersecuritytechnologies/6291 · Telegram Post
• https://t.me/cvenotify/32087 · Telegram Post