CVE-2022-32136: Codesys runtime systems: Access of uninitialised pointer lead to denial of service.
In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-of-service. User interaction is not required.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-32136.
What products are affected by this vulnerability?
Multiple CODESYS products are affected, including CODESYS PLCWinNT and Codesys Runtime Toolkit.
What can a low privileged remote attacker do?
A low privileged remote attacker can craft a request that causes a read access to an uninitialized pointer, resulting in a denial-of-service.
Is user interaction required for this vulnerability to be exploited?
No, user interaction is not required for this vulnerability to be exploited.
What is the severity level of this vulnerability?
The severity level of this vulnerability is medium, with a CVSS score of 6.5.
How can I fix this vulnerability?
To fix this vulnerability, it is recommended to upgrade to a version of CODESYS that is not affected by the issue.
Where can I find more information about this vulnerability?
More information about this vulnerability can be found at the following link: [link](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=)
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The Common Weakness Enumeration (CWE) ID for this vulnerability is CWE-824.