GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-4224 (GCVE-0-2022-4224)

Vulnerability from cvelistv5 – Published: 2023-03-23 11:15 – Updated: 2026-05-29 14:08
VLAI
Title
CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3
Summary
In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-29 14:07 UTC
CWE
  • CWE-1188 - Insecure Default Initialization of Resource
Assigner
References
Impacted products
Vendor Product Version CPE status
CODESYS Control RTE (SL) Affected: 3.0.0.0 , < 3.5.19.0 (custom)
guessed Create a notification for this product.
CODESYS Control RTE (for Beckhoff CX) SL Affected: 3.0.0.0 , < 3.5.19.0 (custom)
guessed Create a notification for this product.
CODESYS Control Win (SL) Affected: 3.0.0.0 , < 3.5.19.0 (custom)
guessed Create a notification for this product.
CODESYS Runtime Toolkit Affected: 3.0.0.0 , < 3.5.19.0 (custom)
guessed Create a notification for this product.
CODESYS Safety SIL2 Runtime Toolkit Affected: 3.0.0.0 , < 3.5.19.0 (custom)
guessed Create a notification for this product.
CODESYS Safety SIL2 PSP Affected: 3.0.0.0 , < 3.5.19.0 (custom)
guessed Create a notification for this product.
CODESYS HMI (SL) Affected: 3.0.0.0 , < 3.5.19.0 (custom)
guessed Create a notification for this product.
CODESYS Development System V3 Affected: 3.0.0.0 , < 3.5.19.0 (custom)
guessed Create a notification for this product.
CODESYS Control for BeagleBone SL Affected: 3.0.0.0 , < 4.8.0.0 (custom)
guessed Create a notification for this product.
CODESYS Control for emPC-A/iMX6 SL Affected: 3.0.0.0 , < 4.8.0.0 (custom)
guessed Create a notification for this product.
CODESYS Control for IOT2000 SL Affected: 3.0.0.0 , < 4.8.0.0 (custom)
guessed Create a notification for this product.
CODESYS Control for Linux SL Affected: 3.0.0.0 , < 4.8.0.0 (custom)
guessed Create a notification for this product.
CODESYS Control for PFC100 SL Affected: 3.0.0.0 , < 4.8.0.0 (custom)
guessed Create a notification for this product.
CODESYS Control for PFC200 SL Affected: 3.0.0.0 , < 4.8.0.0 (custom)
guessed Create a notification for this product.
CODESYS Control for PLCnext SL Affected: 3.0.0.0 , < 4.8.0.0 (custom)
guessed Create a notification for this product.
CODESYS Control for Raspberry Pi SL Affected: 3.0.0.0 , < 4.8.0.0 (custom)
guessed Create a notification for this product.
CODESYS Control for WAGO Touch Panels 600 SL Affected: 3.0.0.0 , < 4.8.0.0 (custom)
guessed Create a notification for this product.
Credits
Franklin Zhao from ELEX FEIGONG RESEARCH INSTITUTE of Elex CyberSecurity Reid Wightman of Dragos
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:34:49.591Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17553\u0026token=cf49757d232ea8021f0c0dd6c65e71ea5942b12d\u0026download="
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-4224",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-29T14:07:26.160566Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-29T14:08:13.754Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Control RTE (SL) ",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.19.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control RTE (for Beckhoff CX) SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.19.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control Win (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.19.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": " Runtime Toolkit ",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.19.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Safety SIL2 Runtime Toolkit",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.19.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Safety SIL2 PSP",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.19.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "HMI (SL) ",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.19.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Development System V3",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.19.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": " Control for BeagleBone SL ",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.8.0.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for emPC-A/iMX6 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.8.0.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for IOT2000 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.8.0.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for Linux SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.8.0.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": " Control for PFC100 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.8.0.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": " Control for PFC200 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.8.0.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for PLCnext SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.8.0.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for Raspberry Pi SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.8.0.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Control for WAGO Touch Panels 600 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.8.0.0",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Franklin Zhao from ELEX FEIGONG RESEARCH INSTITUTE of Elex CyberSecurity"
        },
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Reid Wightman of Dragos"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In multiple products of CODESYS v3 in multiple versions a remote low privileged user\u0026nbsp;could utilize this vulnerability to read and modify system files and OS resources or DoS the device."
            }
          ],
          "value": "In multiple products of CODESYS v3 in multiple versions a remote low privileged user\u00a0could utilize this vulnerability to read and modify system files and OS resources or DoS the device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188 Insecure Default Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-09T10:47:13.144Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17553\u0026token=cf49757d232ea8021f0c0dd6c65e71ea5942b12d\u0026download="
        }
      ],
      "source": {
        "defect": [
          "CERT@VDE#64318"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CODESYS:  Exposure of Resource to Wrong Sphere in CODESYS V3",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2022-4224",
    "datePublished": "2023-03-23T11:15:37.014Z",
    "dateReserved": "2022-11-30T06:54:13.183Z",
    "dateUpdated": "2026-05-29T14:08:13.754Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-4224",
      "date": "2026-09-16",
      "epss": "0.00883",
      "percentile": "0.57388"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"4.8.0.0\", \"matchCriteriaId\": \"40CAED29-E204-459D-8AFC-F814E68FAB9A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:control_for_empc-a\\\\/imx6_sl:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"4.8.0.0\", \"matchCriteriaId\": \"C5E9691E-E67A-4D59-9152-3731DD381CF4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"4.8.0.0\", \"matchCriteriaId\": \"A5FC8BEB-DB37-4486-BAFD-16B82F331F9C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"4.8.0.0\", \"matchCriteriaId\": \"D2821B72-748A-4B3E-BD8B-E55C92A1A166\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"4.8.0.0\", \"matchCriteriaId\": \"680C2604-3774-43D2-9DDE-38A0F593BFF3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"4.8.0.0\", \"matchCriteriaId\": \"D4B2CB47-68F3-4C17-8D61-88F655CF19ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"4.8.0.0\", \"matchCriteriaId\": \"6E3514C8-F513-4576-8F6D-DDB193E3B947\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"4.8.0.0\", \"matchCriteriaId\": \"5059640A-05F0-4D59-9682-BC09F155527C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"4.8.0.0\", \"matchCriteriaId\": \"D7D13CFF-F753-430B-9E03-F3F24066B529\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"3.5.19.0\", \"matchCriteriaId\": \"C27B4D20-FDE3-4003-97BD-F43EE147AD6A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:control_rte_sl_\\\\(for_beckhoff_cx\\\\):*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"3.5.19.0\", \"matchCriteriaId\": \"63A8AFF5-3CC8-43FA-A9D3-A6A53FAF15FC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"3.5.19.0\", \"matchCriteriaId\": \"A1A44FED-CFBB-454A-B8E8-FC11A996488F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"3.5.19.0\", \"matchCriteriaId\": \"8297903A-80E1-4FA7-B552-672B94B6B6B4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"3.5.19.0\", \"matchCriteriaId\": \"57C60464-F6BB-431A-AD96-32B07FD99948\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"3.5.19.0\", \"matchCriteriaId\": \"0032B82B-21B9-4006-A7E4-CD5B92962136\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:codesys:safety_sil2:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"3.5.19.0\", \"matchCriteriaId\": \"B7181873-775F-43A6-BDBB-DBB2879C7D4D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In multiple products of CODESYS v3 in multiple versions a remote low privileged user\\u00a0could utilize this vulnerability to read and modify system files and OS resources or DoS the device.\"}]",
      "id": "CVE-2022-4224",
      "lastModified": "2024-11-21T07:34:49.520",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"info@cert.vde.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
      "published": "2023-03-23T12:15:12.990",
      "references": "[{\"url\": \"https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17553\u0026token=cf49757d232ea8021f0c0dd6c65e71ea5942b12d\u0026download=\", \"source\": \"info@cert.vde.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17553\u0026token=cf49757d232ea8021f0c0dd6c65e71ea5942b12d\u0026download=\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "info@cert.vde.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"info@cert.vde.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-1188\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-1188\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-4224\",\"sourceIdentifier\":\"info@cert.vde.com\",\"published\":\"2023-03-23T12:15:12.990\",\"lastModified\":\"2026-06-17T05:20:18.343\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In multiple products of CODESYS v3 in multiple versions a remote low privileged user\u00a0could utilize this vulnerability to read and modify system files and OS resources or DoS the device.\"}],\"affected\":[{\"source\":\"info@cert.vde.com\",\"affectedData\":[{\"vendor\":\"CODESYS\",\"product\":\"Control RTE (SL) \",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"3.5.19.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control RTE (for Beckhoff CX) SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"3.5.19.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control Win (SL)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"3.5.19.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\" Runtime Toolkit \",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"3.5.19.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Safety SIL2 Runtime Toolkit\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"3.5.19.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Safety SIL2 PSP\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"3.5.19.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"HMI (SL) \",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"3.5.19.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Development System V3\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"3.5.19.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\" Control for BeagleBone SL \",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"4.8.0.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for emPC-A/iMX6 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"4.8.0.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for IOT2000 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"4.8.0.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for Linux SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"4.8.0.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\" Control for PFC100 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"4.8.0.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\" Control for PFC200 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"4.8.0.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for PLCnext SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"4.8.0.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for Raspberry Pi SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"4.8.0.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"CODESYS\",\"product\":\"Control for WAGO Touch Panels 600 SL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.0.0.0\",\"lessThan\":\"4.8.0.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-29T14:07:26.160566Z\",\"id\":\"CVE-2022-4224\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1188\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1188\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"4.8.0.0\",\"matchCriteriaId\":\"40CAED29-E204-459D-8AFC-F814E68FAB9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:control_for_empc-a\\\\/imx6_sl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"4.8.0.0\",\"matchCriteriaId\":\"C5E9691E-E67A-4D59-9152-3731DD381CF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"4.8.0.0\",\"matchCriteriaId\":\"A5FC8BEB-DB37-4486-BAFD-16B82F331F9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"4.8.0.0\",\"matchCriteriaId\":\"D2821B72-748A-4B3E-BD8B-E55C92A1A166\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"4.8.0.0\",\"matchCriteriaId\":\"680C2604-3774-43D2-9DDE-38A0F593BFF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"4.8.0.0\",\"matchCriteriaId\":\"D4B2CB47-68F3-4C17-8D61-88F655CF19ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"4.8.0.0\",\"matchCriteriaId\":\"6E3514C8-F513-4576-8F6D-DDB193E3B947\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"4.8.0.0\",\"matchCriteriaId\":\"5059640A-05F0-4D59-9682-BC09F155527C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"4.8.0.0\",\"matchCriteriaId\":\"D7D13CFF-F753-430B-9E03-F3F24066B529\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"3.5.19.0\",\"matchCriteriaId\":\"C27B4D20-FDE3-4003-97BD-F43EE147AD6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:control_rte_sl_\\\\(for_beckhoff_cx\\\\):*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"3.5.19.0\",\"matchCriteriaId\":\"63A8AFF5-3CC8-43FA-A9D3-A6A53FAF15FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"3.5.19.0\",\"matchCriteriaId\":\"A1A44FED-CFBB-454A-B8E8-FC11A996488F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"3.5.19.0\",\"matchCriteriaId\":\"8297903A-80E1-4FA7-B552-672B94B6B6B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"3.5.19.0\",\"matchCriteriaId\":\"57C60464-F6BB-431A-AD96-32B07FD99948\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"3.5.19.0\",\"matchCriteriaId\":\"0032B82B-21B9-4006-A7E4-CD5B92962136\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:safety_sil2:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"3.5.19.0\",\"matchCriteriaId\":\"B7181873-775F-43A6-BDBB-DBB2879C7D4D\"}]}]}],\"references\":[{\"url\":\"https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17553\u0026token=cf49757d232ea8021f0c0dd6c65e71ea5942b12d\u0026download=\",\"source\":\"info@cert.vde.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17553\u0026token=cf49757d232ea8021f0c0dd6c65e71ea5942b12d\u0026download=\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-29T02:56:17+00:00",
      "cve": "CVE-2022-4224",
      "id": "CVE-2022-4224",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CODESYS:  Exposure of Resource to Wrong Sphere in CODESYS V3",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-4224.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"Control RTE (SL) \", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"3.5.19.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"Control RTE (for Beckhoff CX) SL\", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"3.5.19.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"Control Win (SL)\", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"3.5.19.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \" Runtime Toolkit \", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"3.5.19.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"Safety SIL2 Runtime Toolkit\", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"3.5.19.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"Safety SIL2 PSP\", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"3.5.19.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"HMI (SL) \", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"3.5.19.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"Development System V3\", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"3.5.19.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \" Control for BeagleBone SL \", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"4.8.0.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"Control for emPC-A/iMX6 SL\", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"4.8.0.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"Control for IOT2000 SL\", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"4.8.0.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"Control for Linux SL\", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"4.8.0.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \" Control for PFC100 SL\", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"4.8.0.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \" Control for PFC200 SL\", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"4.8.0.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"Control for PLCnext SL\", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"4.8.0.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"Control for Raspberry Pi SL\", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"4.8.0.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"Control for WAGO Touch Panels 600 SL\", \"vendor\": \"CODESYS\", \"versions\": [{\"lessThan\": \"4.8.0.0\", \"status\": \"affected\", \"version\": \"3.0.0.0\", \"versionType\": \"custom\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Franklin Zhao from ELEX FEIGONG RESEARCH INSTITUTE of Elex CyberSecurity\"}, {\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Reid Wightman of Dragos\"}], \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"In multiple products of CODESYS v3 in multiple versions a remote low privileged user\u0026nbsp;could utilize this vulnerability to read and modify system files and OS resources or DoS the device.\"}], \"value\": \"In multiple products of CODESYS v3 in multiple versions a remote low privileged user\\u00a0could utilize this vulnerability to read and modify system files and OS resources or DoS the device.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-1188\", \"description\": \"CWE-1188 Insecure Default Initialization of Resource\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"270ccfa6-a436-4e77-922e-914ec3a9685c\", \"shortName\": \"CERTVDE\", \"dateUpdated\": \"2023-08-09T10:47:13.144Z\"}, \"references\": [{\"url\": \"https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17553\u0026token=cf49757d232ea8021f0c0dd6c65e71ea5942b12d\u0026download=\"}], \"source\": {\"defect\": [\"CERT@VDE#64318\"], \"discovery\": \"EXTERNAL\"}, \"title\": \"CODESYS:  Exposure of Resource to Wrong Sphere in CODESYS V3\", \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T01:34:49.591Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17553\u0026token=cf49757d232ea8021f0c0dd6c65e71ea5942b12d\u0026download=\", \"tags\": [\"x_transferred\"]}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-4224\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-29T14:07:26.160566Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-29T14:07:41.618Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-4224\", \"assignerOrgId\": \"270ccfa6-a436-4e77-922e-914ec3a9685c\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"CERTVDE\", \"dateReserved\": \"2022-11-30T06:54:13.183Z\", \"datePublished\": \"2023-03-23T11:15:37.014Z\", \"dateUpdated\": \"2026-05-29T14:08:13.754Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.