No known public exploitation specifically targeting this these vulnerabilities has been reported to CISA at this time.
Credit: Rockwell Automation
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2022-47379 | CWE-787 Out-of-bounds Write | 8.8 High |
After successful authentication, specifically crafted communication requests can cause the CmpApp component to write threat actor-controlled data to memory, which can lead to a denial-of-service condition, memory overwriting, or remote code execution. Mitigation: Rockwell Automation recommends users with the affected software apply the following risk mitigations, if possible: Mitigation: Upgrade to CODESYS version 3.5.19.2 which has been released to mitigate these issues. ↗ Mitigation: Additionally, we encourage the customer to implement our suggested security best practices to minimize risk of the vulnerability. ↗ Affected, fixed & timelineAffected:
Mitigation: Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization. Mitigation: Additional information can be found in the CODESYS Advisory. |
| CVE-2022-47380 | CWE-121 Stack-based Buffer Overflow | 8.8 High |
After successful authentication, specifically crafted communication requests can cause the CmpApp component to write threat actor-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution. Mitigation: Rockwell Automation recommends users with the affected software apply the following risk mitigations, if possible: Mitigation: Upgrade to CODESYS version 3.5.19.2 which has been released to mitigate these issues. ↗ Mitigation: Additionally, we encourage the customer to implement our suggested security best practices to minimize risk of the vulnerability. ↗ Affected, fixed & timelineAffected:
Mitigation: Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization. Mitigation: Additional information can be found in the CODESYS Advisory. |
| CVE-2022-47381 | CWE-121 Stack-based Buffer Overflow | 8.8 High |
After successful authentication, specifically crafted communication requests can cause the CmpApp component to write threat actor-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution. Mitigation: Rockwell Automation recommends users with the affected software apply the following risk mitigations, if possible: Mitigation: Upgrade to CODESYS version 3.5.19.2 which has been released to mitigate these issues. ↗ Mitigation: Additionally, we encourage the customer to implement our suggested security best practices to minimize risk of the vulnerability. ↗ Affected, fixed & timelineAffected:
Mitigation: Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization. Mitigation: Additional information can be found in the CODESYS Advisory. |
| CVE-2022-47382 | CWE-121 Stack-based Buffer Overflow | 8.8 High |
After successful authentication, specifically crafted communication requests can cause the CmpTraceMgr component to write threat actor-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution. Mitigation: Rockwell Automation recommends users with the affected software apply the following risk mitigations, if possible: Mitigation: Upgrade to CODESYS version 3.5.19.2 which has been released to mitigate these issues. ↗ Mitigation: Additionally, we encourage the customer to implement our suggested security best practices to minimize risk of the vulnerability. ↗ Affected, fixed & timelineAffected:
Mitigation: Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization. Mitigation: Additional information can be found in the CODESYS Advisory. |
| CVE-2022-47383 | CWE-121 Stack-based Buffer Overflow | 8.8 High |
After successful authentication, specifically crafted communication requests can cause the CmpTraceMgr component to write threat actor-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution. Mitigation: Rockwell Automation recommends users with the affected software apply the following risk mitigations, if possible: Mitigation: Upgrade to CODESYS version 3.5.19.2 which has been released to mitigate these issues. ↗ Mitigation: Additionally, we encourage the customer to implement our suggested security best practices to minimize risk of the vulnerability. ↗ Affected, fixed & timelineAffected:
Mitigation: Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization. Mitigation: Additional information can be found in the CODESYS Advisory. |
| CVE-2022-47384 | CWE-121 Stack-based Buffer Overflow | 8.8 High |
After successful authentication, specifically crafted communication requests can cause the CmpTraceMgr component to write threat actor-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution. Mitigation: Rockwell Automation recommends users with the affected software apply the following risk mitigations, if possible: Mitigation: Upgrade to CODESYS version 3.5.19.2 which has been released to mitigate these issues. ↗ Mitigation: Additionally, we encourage the customer to implement our suggested security best practices to minimize risk of the vulnerability. ↗ Affected, fixed & timelineAffected:
Mitigation: Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization. Mitigation: Additional information can be found in the CODESYS Advisory. |
| CVE-2022-47385 | CWE-121 Stack-based Buffer Overflow | 8.8 High |
After successful authentication, specifically crafted communication requests can cause the CmpAppForce component to write threat actor-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution. Mitigation: Rockwell Automation recommends users with the affected software apply the following risk mitigations, if possible: Mitigation: Upgrade to CODESYS version 3.5.19.2 which has been released to mitigate these issues. ↗ Mitigation: Additionally, we encourage the customer to implement our suggested security best practices to minimize risk of the vulnerability. ↗ Affected, fixed & timelineAffected:
Mitigation: Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization. Mitigation: Additional information can be found in the CODESYS Advisory. |
| CVE-2022-47386 | CWE-121 Stack-based Buffer Overflow | 8.8 High |
After successful authentication, specifically crafted communication requests can cause the CmpTraceMgr component to write threat actor-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution. Mitigation: Rockwell Automation recommends users with the affected software apply the following risk mitigations, if possible: Mitigation: Upgrade to CODESYS version 3.5.19.2 which has been released to mitigate these issues. ↗ Mitigation: Additionally, we encourage the customer to implement our suggested security best practices to minimize risk of the vulnerability. ↗ Affected, fixed & timelineAffected:
Mitigation: Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization. Mitigation: Additional information can be found in the CODESYS Advisory. |
| CVE-2022-47387 | CWE-121 Stack-based Buffer Overflow | 8.8 High |
After successful authentication, specifically crafted communication requests can cause the CmpTraceMgr component to write threat actor-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution. Mitigation: Rockwell Automation recommends users with the affected software apply the following risk mitigations, if possible: Mitigation: Upgrade to CODESYS version 3.5.19.2 which has been released to mitigate these issues. ↗ Mitigation: Additionally, we encourage the customer to implement our suggested security best practices to minimize risk of the vulnerability. ↗ Affected, fixed & timelineAffected:
Mitigation: Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization. Mitigation: Additional information can be found in the CODESYS Advisory. |
| CVE-2022-47388 | CWE-121 Stack-based Buffer Overflow | 8.8 High |
After successful authentication, specifically crafted communication requests can cause the CmpTraceMgr component to write threat actor-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution. Mitigation: Rockwell Automation recommends users with the affected software apply the following risk mitigations, if possible: Mitigation: Upgrade to CODESYS version 3.5.19.2 which has been released to mitigate these issues. ↗ Mitigation: Additionally, we encourage the customer to implement our suggested security best practices to minimize risk of the vulnerability. ↗ Affected, fixed & timelineAffected:
Mitigation: Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization. Mitigation: Additional information can be found in the CODESYS Advisory. |
| CVE-2022-47389 | CWE-121 Stack-based Buffer Overflow | 8.8 High |
After successful authentication, specifically crafted communication requests can cause the CmpTraceMgr component to write threat actor-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution. Mitigation: Rockwell Automation recommends users with the affected software apply the following risk mitigations, if possible: Mitigation: Upgrade to CODESYS version 3.5.19.2 which has been released to mitigate these issues. ↗ Mitigation: Additionally, we encourage the customer to implement our suggested security best practices to minimize risk of the vulnerability. ↗ Affected, fixed & timelineAffected:
Mitigation: Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization. Mitigation: Additional information can be found in the CODESYS Advisory. |
| CVE-2022-47390 | CWE-121 Stack-based Buffer Overflow | 8.8 High |
After successful authentication, specifically crafted communication requests can cause the CmpTraceMgr component to write threat actor-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution. Mitigation: Rockwell Automation recommends users with the affected software apply the following risk mitigations, if possible: Mitigation: Upgrade to CODESYS version 3.5.19.2 which has been released to mitigate these issues. ↗ Mitigation: Additionally, we encourage the customer to implement our suggested security best practices to minimize risk of the vulnerability. ↗ Affected, fixed & timelineAffected:
Mitigation: Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization. Mitigation: Additional information can be found in the CODESYS Advisory. |
| CVE-2022-47378 | CWE-1288 Improper Validation of Consistency within Input | 6.5 Medium |
After successful authentication, specifically crafted communication requests with inconsistent content can cause the CmpFiletransfer component to read internally from an invalid address, potentially leading to a denial-of-service condition. Mitigation: Rockwell Automation recommends users with the affected software apply the following risk mitigations, if possible: Mitigation: Upgrade to CODESYS version 3.5.19.2 which has been released to mitigate these issues. ↗ Mitigation: Additionally, we encourage the customer to implement our suggested security best practices to minimize risk of the vulnerability. ↗ Affected, fixed & timelineAffected:
Mitigation: Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization. Mitigation: Additional information can be found in the CODESYS Advisory. |
| CVE-2022-47392 | CWE-1288 Improper Validation of Consistency within Input | 6.5 Medium |
After successful authentication, specifically crafted communication requests with inconsistent content can cause the CmpApp/CmpAppBP/CmpAppForce components to read internally from an invalid address, potentially leading to a denial-of-service condition. Mitigation: Rockwell Automation recommends users with the affected software apply the following risk mitigations, if possible: Mitigation: Upgrade to CODESYS version 3.5.19.2 which has been released to mitigate these issues. ↗ Mitigation: Additionally, we encourage the customer to implement our suggested security best practices to minimize risk of the vulnerability. ↗ Affected, fixed & timelineAffected:
Mitigation: Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization. Mitigation: Additional information can be found in the CODESYS Advisory. |
| CVE-2022-47393 | CWE-822 Untrusted Pointer Dereference | 6.5 Medium |
After successful authentication, specifically crafted communication requests can cause the cmpFiletransfer component to dereference addresses provided by the request for internal read access, which can lead to a denial-of-service situation. Mitigation: Rockwell Automation recommends users with the affected software apply the following risk mitigations, if possible: Mitigation: Upgrade to CODESYS version 3.5.19.2 which has been released to mitigate these issues. ↗ Mitigation: Additionally, we encourage the customer to implement our suggested security best practices to minimize risk of the vulnerability. ↗ Affected, fixed & timelineAffected:
Mitigation: Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization. Mitigation: Additional information can be found in the CODESYS Advisory. |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2022-47379 | 8.8 High | CODESYS CODESYS Control RTE (SL) An authenticated, remote attacker may use a out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into me… |
| CVE-2022-47380 | 8.8 High | CODESYS CODESYS Control RTE (SL) An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write … |
| CVE-2022-47381 | 8.8 High | CODESYS CODESYS Control RTE (SL) An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write d… |
| CVE-2022-47382 | 8.8 High | CODESYS CODESYS Control RTE (SL) An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in… |
| CVE-2022-47383 | 8.8 High | CODESYS CODESYS Control RTE (SL) An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products i… |
| CVE-2022-47384 | 8.8 High | CODESYS CODESYS Control RTE (SL) An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in… |
| CVE-2022-47385 | 8.8 High | CODESYS CODESYS Control RTE (SL) An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products i… |
| CVE-2022-47386 | 8.8 High | CODESYS CODESYS Control RTE (SL) An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products i… |
| CVE-2022-47387 | 8.8 High | CODESYS CODESYS Control RTE (SL) An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in… |
| CVE-2022-47388 | 8.8 High | CODESYS CODESYS Control RTE (SL) An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products i… |
| CVE-2022-47389 | 8.8 High | CODESYS CODESYS Control RTE (SL) An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products i… |
| CVE-2022-47390 | 8.8 High | CODESYS CODESYS Control RTE (SL) An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products i… |
| CVE-2022-47378 | 6.5 Medium | CODESYS CODESYS Control RTE (SL) Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft spe… |
| CVE-2022-47392 | 6.5 Medium | CODESYS CODESYS Control RTE (SL) An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS… |
| CVE-2022-47393 | 6.5 Medium | CODESYS CODESYS Control RTE (SL) An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple version… |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.