Read the docs
TI-2022-03714 Aliases CVE-2022-4048GHSA-hxgf-g28h-m63f

CODESYS V3 prone to Inadequate Encryption Stregth

Priority LOW 34CWE-326Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-326.

Summary

Inadequate Encryption Strength in CODESYS Development System V3 versions prior to V3.5.18.40 allows an unauthenticated local attacker to access and manipulate code of the encrypted boot application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00083 0th percentileScored 2026-11-07
Fix Fixed CODESYS Development System V3 (CODESYS): V3.5.18.40

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CODESYSCODESYS Development System V3V0.0.0.0 to before V3.5.18.40V3.5.18.40Patch availableCNA
  • CODESYS Development System V3 VendorCODESYS Affected V0.0.0.0 to before V3.5.18.40 Fixed in V3.5.18.40 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:codesys:development_system_v3:*:*:*:*:*:*:*:*before 3.5.18.40VulnerableCODESYS
  • cpe:2.3:a:codesys:development_system_v3:*:*:*:*:*:*:*:* Versions before 3.5.18.40 Vulnerable ·CODESYS

Remediation

  • Fix · CNA CODESYS Development System V3 (CODESYS) Fixed in V3.5.18.40

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-4048
  2. 2026-10-03 Alias added: GHSA-hxgf-g28h-m63f

References

Advisory 1

  • TI-2018-07501 Improper access control in 3S-Smart Software Solutions GmbH CODESYS Control V3 products… CVSS 3.0CRITICAL 9.8
  • TI-2022-23467 CODESYS: Multiple products prone to out-of-bounds write CVSS 3.1HIGH 8.8
  • TI-2022-23479 CODESYS: Multiple products prone to Improper Input Validation CVSS 3.1HIGH 7.5
  • TI-2022-23478 CODESYS: Multiple products prone to stack based out-of-bounds write CVSS 3.1HIGH 8.8
  • TI-2022-23477 CODESYS: Multiple products prone to stack based out-of-bounds write CVSS 3.1HIGH 8.8
  • TI-2022-23476 CODESYS: Multiple products prone to stack based out-of-bounds write CVSS 3.1HIGH 8.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences