CVE-2022-32143: CODESYS runtime system prone to directory acces
In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller only if no level 1 password is configured on the controller or if remote attacker has previously successfully authenticated himself to the controller. A successful Attack may lead to a denial of service, change of local files, or drain of confidential Information. User interaction is not required
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-32143?
CVE-2022-32143 is a vulnerability in multiple CODESYS products that allows for unauthorized access to internal files in the working directory.
What is the severity of CVE-2022-32143?
CVE-2022-32143 has a severity rating of 8.8, which is classified as high.
Which products are affected by CVE-2022-32143?
CVE-2022-32143 affects CODESYS PLCWinNT and Codesys Runtime Toolkit versions 2.0 to 2.4.7.57.
How does CVE-2022-32143 allow unauthorized access to internal files?
CVE-2022-32143 allows access to internal files through the file download and upload function in CODESYS products.
Is there a fix for CVE-2022-32143?
At the time of writing, no specific fix or patch has been mentioned for CVE-2022-32143. It is recommended to follow the vendor's advisories and apply any updates or mitigations provided.