PT-2022-21116 · 3S Smart Software Solutions · Codesys

Rigoblock · Published 2022-06-24 · Updated 2022-07-01 · CVE-2022-32143

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CODESYS products (affected versions not specified)

Description The issue allows access to internal files in the working directory, such as firmware files of the PLC, through the file download and upload function. This is possible if no level 1 password is configured on the controller or if a remote attacker has previously successfully authenticated to the controller. A successful attack may lead to a denial of service, change of local files, or drain of confidential information. User interaction is not required.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2022-32143

Affected Products

Codesys

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-32143 · Security Note
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download= · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32143 · Vendor Advisory
• https://t.me/cvenotify/32090 · Telegram Post