CVE-2022-1965: CODESYS runtime system prone to file deletion due to improper error handling
Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-1965?
CVE-2022-1965 refers to a vulnerability in multiple products of CODESYS that implement improper error handling, allowing a low privilege remote attacker to delete a file referenced by a crafted request.
What is the severity of CVE-2022-1965?
CVE-2022-1965 has a severity rating of 8.1, which is considered high.
Which products are affected by CVE-2022-1965?
CVE-2022-1965 affects the CODESYS PLCWinNT version 2.0 to 2.4.7.57, as well as the Codesys Runtime Toolkit version 2.0 to 2.4.7.57.
How can an attacker exploit CVE-2022-1965?
A low privilege remote attacker can exploit CVE-2022-1965 by crafting a request that is not properly processed by the error handling, leading to the deletion of a referenced file.
Is user interaction required for CVE-2022-1965 to be exploited?
No, user interaction is not required for CVE-2022-1965 to be exploited.