CVE-2022-31805
Vulnerability from cvelistv5
Published
2022-06-24 07:46
Modified
2024-09-16 18:55
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Insecure transmission of credentials
References
info@cert.vde.comhttps://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17140&token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c&download=Vendor Advisory
Impacted products
CODESYSCODESYS Development System
CODESYSCODESYS Gateway Client
CODESYSCODESYS Gateway Server
CODESYSCODESYS Web server
CODESYSCODESYS SP Realtime NT
CODESYSCODESYS PLCWinNT
CODESYSCODESYS Runtime Toolkit 32 bit full
CODESYSCODESYS Edge Gateway for Windows
CODESYSCODESYS HMI (SL)
CODESYSCODESYS OPC DA Server SL
CODESYSCODESYS PLCHandler
CODESYSCODESYS Gateway
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:01.086Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download="
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Development System",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.3.9.69",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            },
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Gateway Client",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.3.9.38",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Gateway Server",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.3.9.38",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Web server",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V1.1.9.23",
              "status": "affected",
              "version": "V1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS SP Realtime NT",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.3.7.30",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS PLCWinNT",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.4.7.57",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Runtime Toolkit 32 bit full",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.4.7.57",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Edge Gateway for Windows",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS HMI (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS OPC DA Server SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS PLCHandler",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Gateway",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2022-06-22T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.\u003c/p\u003e"
            }
          ],
          "value": "In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-523",
              "description": "CWE-523 Unprotected Transport of Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-09T12:54:39.506Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download="
        }
      ],
      "source": {
        "defect": [
          "CERT@VDE#",
          "64140"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Insecure transmission of credentials",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "info@cert.vde.com",
          "DATE_PUBLIC": "2022-06-23T10:00:00.000Z",
          "ID": "CVE-2022-31805",
          "STATE": "PUBLIC",
          "TITLE": "Insecure transmission of credentials"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CODESYS Development System",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.3.9.69"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Gateway Client",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.3.9.38"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Gateway Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.3.9.38"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Web server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V1",
                            "version_value": "V1.1.9.23"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS SP Realtime NT",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.3.7.30"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS PLCWinNT",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.4.7.57"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Runtime Toolkit 32 bit full",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.4.7.57"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Edge Gateway for Windows",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS HMI (SL)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS OPC DA Server SL",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS PLCHandler",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Gateway",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "CODESYS"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-523 Unprotected Transport of Credentials"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download=",
              "refsource": "CONFIRM",
              "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download="
            }
          ]
        },
        "source": {
          "defect": [
            "CERT@VDE#",
            "64140"
          ],
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2022-31805",
    "datePublished": "2022-06-24T07:46:15.076016Z",
    "dateReserved": "2022-05-30T00:00:00",
    "dateUpdated": "2024-09-16T18:55:26.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-31805\",\"sourceIdentifier\":\"info@cert.vde.com\",\"published\":\"2022-06-24T08:15:07.590\",\"lastModified\":\"2024-09-16T19:16:03.700\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.\"},{\"lang\":\"es\",\"value\":\"En CODESYS Development System, varios componentes en diversos versiones transmiten las contrase\u00f1as para la comunicaci\u00f3n entre clientes y servidores sin protecci\u00f3n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:N/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-523\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.3.9.69\",\"matchCriteriaId\":\"85D06342-38A2-4E95-BE56-08D54271E41F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:edge_gateway:*:*:*:*:*:windows:*:*\",\"versionEndExcluding\":\"3.5.18.30\",\"matchCriteriaId\":\"EC5C6832-F0B3-46DF-8047-22A2544D937C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:gateway:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.3.9.38\",\"matchCriteriaId\":\"6B9AE405-A0E5-48FF-9E8C-1A323D296445\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.5.18.30\",\"matchCriteriaId\":\"F23A1B9F-97EE-4E4C-AAB9-511B4A3ED98C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:opc_server:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.5.18.30\",\"matchCriteriaId\":\"46CDFB44-9702-4978-B577-9D07DF3D04B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:plchandler:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.5.18.30\",\"matchCriteriaId\":\"4932F620-43F8-4F3F-80AE-CD603BF05962\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:plcwinnt:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.4.7.57\",\"matchCriteriaId\":\"6887DEB0-5C13-4D7B-86E6-504D8CBB2A0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:x86:*\",\"versionEndExcluding\":\"2.4.7.57\",\"matchCriteriaId\":\"5A605019-68F5-4C21-96BD-C300DECAA3D8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:sp_realtime_nt:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.3.7.30\",\"matchCriteriaId\":\"14F1D049-7DF2-453A-9D5A-7FCBCAD465E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:web_server:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.1.9.23\",\"matchCriteriaId\":\"971AF379-F2B6-4791-B153-718517CA3E62\"}]}]}],\"references\":[{\"url\":\"https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download=\",\"source\":\"info@cert.vde.com\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.