Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-47385: An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple versions to write data into the stack...

CVE-2022-47385 · published 3 years ago

Summary

An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.

What to do

Update codesys control_for_beaglebone_sl to version 4.8.0.0 or later.
Update codesys control_for_empc-a\/imx6_sl to version 4.8.0.0 or later.
Update codesys control_for_iot2000_sl to version 4.8.0.0 or later.
Update codesys control_for_linux_sl to version 4.8.0.0 or later.
Update codesys control_for_pfc100_sl to version 4.8.0.0 or later.
Update codesys control_for_pfc200_sl to version 4.8.0.0 or later.
Update codesys control_for_plcnext_sl to version 4.8.0.0 or later.
Update codesys control_for_raspberry_pi_sl to version 4.8.0.0 or later.
Update codesys control_for_wago_touch_panels_600_sl to version 4.8.0.0 or later.
Update codesys control_rte_\(for_beckhoff_cx\)_sl to version 3.5.19.0 or later.
Update codesys control_rte_\(sl\) to version 3.5.19.0 or later.
Update codesys control_runtime_system_toolkit to version 3.5.19.0 or later.
Update codesys control_win_\(sl\) to version 3.5.19.0 or later.
Update codesys development_system_v3 to version 3.5.19.0 or later.
Update codesys hmi_\(sl\) to version 3.5.19.0 or later.
Update codesys safety_sil2_psp to version 3.5.19.0 or later.
Update codesys safety_sil2_runtime_toolkit to version 3.5.19.0 or later.

Affected software

Vendor	Product	Affected versions
codesys	control_for_beaglebone_sl	< 4.8.0.0 `cpe:2.3:a:codesys:control_for_beaglebone_sl::::::::`
codesys	control_for_empc-a\/imx6_sl	< 4.8.0.0 `cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl::::::::`
codesys	control_for_iot2000_sl	< 4.8.0.0 `cpe:2.3:a:codesys:control_for_iot2000_sl::::::::`
codesys	control_for_linux_sl	< 4.8.0.0 `cpe:2.3:a:codesys:control_for_linux_sl::::::::`
codesys	control_for_pfc100_sl	< 4.8.0.0 `cpe:2.3:a:codesys:control_for_pfc100_sl::::::::`
codesys	control_for_pfc200_sl	< 4.8.0.0 `cpe:2.3:a:codesys:control_for_pfc200_sl::::::::`
codesys	control_for_plcnext_sl	< 4.8.0.0 `cpe:2.3:a:codesys:control_for_plcnext_sl::::::::`
codesys	control_for_raspberry_pi_sl	< 4.8.0.0 `cpe:2.3:a:codesys:control_for_raspberry_pi_sl::::::::`
codesys	control_for_wago_touch_panels_600_sl	< 4.8.0.0 `cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl::::::::`
codesys	control_rte_\(for_beckhoff_cx\)_sl	< 3.5.19.0 `cpe:2.3:a:codesys:control_rte_\(for_beckhoff_cx\)_sl::::::::`
codesys	control_rte_\(sl\)	< 3.5.19.0 `cpe:2.3:a:codesys:control_rte_\(sl\)::::::::`
codesys	control_runtime_system_toolkit	< 3.5.19.0 `cpe:2.3:a:codesys:control_runtime_system_toolkit::::::::`
codesys	control_win_\(sl\)	< 3.5.19.0 `cpe:2.3:a:codesys:control_win_\(sl\)::::::::`
codesys	development_system_v3	< 3.5.19.0 `cpe:2.3:a:codesys:development_system_v3::::::::`
codesys	hmi_\(sl\)	< 3.5.19.0 `cpe:2.3:a:codesys:hmi_\(sl\)::::::::`
codesys	safety_sil2_psp	< 3.5.19.0 `cpe:2.3:a:codesys:safety_sil2_psp::::::::`
codesys	safety_sil2_runtime_toolkit	< 3.5.19.0 `cpe:2.3:a:codesys:safety_sil2_runtime_toolkit::::::::`

Original advisory text

References

https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17554&token=5444f53b4... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published15 May 2023

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2022-47385 · NVD

Track software like this

Free during beta