CISA also recommends users take the following measures to protect themselves from social engineering attacks:
Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: CERT@VDE; Rob Hulsebos, Daniel dos Santos (Forescout)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2022-31806 | CWE-1188 Initialization of a Resource with an Insecure Default | 9.8 Critical |
In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller. Mitigation: Festo has identified the following specific workarounds and mitigations users can apply to reduce risk: Mitigation: For CVE-2022-31806: Enable password protection at login in case no password is set at the controller. Please note that the password configuration file is not covered via default FFT backup & Restore mechanism, you must select the related file manually. Mitigation: For more information see the associated Festo SE & Co. KG security advisory FSA-202208 FSA-202208: Festo: Multiple Festo products contain an unsafe default Codesys configuration - HTML, FSA-202208: Festo: Multiple Festo products contain an unsafe default Code… ↗ Affected, fixed & timelineAffected:
Mitigation: For more information see the associated Festo SE & Co. KG security advisory FSA-202208 FSA-202208: Festo: Multiple Festo products contain an unsafe default Codesys configuration - HTML, FSA-202208: Festo: Multiple Festo products contain an unsafe default Codesys configuration - CSAF. |
| CVE-2022-22515 | CWE-668 Exposure of Resource to Wrong Sphere | 8.1 High |
A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products. Mitigation: Festo has identified the following specific workarounds and mitigations users can apply to reduce risk: Mitigation: For CVE-2022-22515: Using the online user management prevents an attacker from downloading and executing malicious code, but also suppresses start, stop, debug, or other actions on a known working application that could potentially disrupt a machine or system. Mitigation: For more information see the associated Festo SE & Co. KG security advisory FSA-202208 FSA-202208: Festo: Multiple Festo products contain an unsafe default Codesys configuration - HTML, FSA-202208: Festo: Multiple Festo products contain an unsafe default Code… ↗ Affected, fixed & timelineAffected:
Mitigation: For more information see the associated Festo SE & Co. KG security advisory FSA-202208 FSA-202208: Festo: Multiple Festo products contain an unsafe default Codesys configuration - HTML, FSA-202208: Festo: Multiple Festo products contain an unsafe default Codesys configuration - CSAF. |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2022-31806 | 9.8 Critical | CODESYS CODESYS PLCWinNT In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no informatio… |
| CVE-2022-22515 | 8.1 High | CODESYS CODESYS Control RTE (SL) A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read an… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.