CVE-2022-32136: Codesys runtime systems: Access of uninitialised pointer lead to denial of service.
First published: Fri Jun 24 2022(Updated: )
In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-of-service. User interaction is not required.
Credit: info@cert.vde.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CODESYS PLCWinNT | >=2.0<2.4.7.57 | |
| Codesys Runtime Toolkit | >=2.0<2.4.7.57 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-32136.
What products are affected by this vulnerability?
Multiple CODESYS products are affected, including CODESYS PLCWinNT and Codesys Runtime Toolkit.
What can a low privileged remote attacker do?
A low privileged remote attacker can craft a request that causes a read access to an uninitialized pointer, resulting in a denial-of-service.
Is user interaction required for this vulnerability to be exploited?
No, user interaction is not required for this vulnerability to be exploited.
What is the severity level of this vulnerability?
The severity level of this vulnerability is medium, with a CVSS score of 6.5.
How can I fix this vulnerability?
To fix this vulnerability, it is recommended to upgrade to a version of CODESYS that is not affected by the issue.
Where can I find more information about this vulnerability?
More information about this vulnerability can be found at the following link: [link](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=)
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The Common Weakness Enumeration (CWE) ID for this vulnerability is CWE-824.
- collector/nvd-index
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/severity
- agent/references
- agent/title
- agent/first-publish-date
- agent/tags
- agent/event
- agent/description
- vendor/codesys
- canonical/codesys plcwinnt
- version/codesys plcwinnt/2.0
- canonical/codesys runtime toolkit
- version/codesys runtime toolkit/2.0