PT-2022-3271 · 3S Smart Software Solutions · Codesys Runtime Toolkit

Published 2022-06-24 · Updated 2022-07-01 · CVE-2022-32137

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CODESYS products (affected versions not specified)

Description A low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-service condition or memory overwrite. User interaction is not required. The issue is caused by a buffer overflow in the dynamic memory of the CODESYS Runtime Toolkit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2022-03995

CVE-2022-32137

Affected Products

Codesys Runtime Toolkit

References · 7

• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download= · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32137 · Security Note
• https://bdu.fstec.ru/vul/2022-03995 · Security Note
• https://osv.dev/vulnerability/CVE-2022-32137 · Vendor Advisory
• https://t.me/cvenotify/32086 · Telegram Post
• https://t.me/cybersecuritytechnologies/6291 · Telegram Post
• https://t.me/cvenotify/32482 · Telegram Post