Read the docs
TI-2022-03868 Aliases CVE-2022-4224GHSA-p8q2-j5x8-g597

CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3

Priority MEDIUM 42CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00883 59th percentileScored 2026-11-07
Fix Fixed Control RTE (SL) (CODESYS): 3.5.19.0Control RTE (for Beckhoff CX) SL (CODESYS): 3.5.19.0+15 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CODESYSControl RTE (SL) 3.0.0.0 to before 3.5.19.03.5.19.0Patch availableCNA
CODESYSControl RTE (for Beckhoff CX) SL3.0.0.0 to before 3.5.19.03.5.19.0Patch availableCNA
CODESYSControl Win (SL)3.0.0.0 to before 3.5.19.03.5.19.0Patch availableCNA
CODESYS Runtime Toolkit 3.0.0.0 to before 3.5.19.03.5.19.0Patch availableCNA
CODESYSSafety SIL2 Runtime Toolkit3.0.0.0 to before 3.5.19.03.5.19.0Patch availableCNA
CODESYSSafety SIL2 PSP3.0.0.0 to before 3.5.19.03.5.19.0Patch availableCNA
CODESYSHMI (SL) 3.0.0.0 to before 3.5.19.03.5.19.0Patch availableCNA
CODESYSDevelopment System V33.0.0.0 to before 3.5.19.03.5.19.0Patch availableCNA
CODESYS Control for BeagleBone SL 3.0.0.0 to before 4.8.0.04.8.0.0Patch availableCNA
CODESYSControl for emPC-A/iMX6 SL3.0.0.0 to before 4.8.0.04.8.0.0Patch availableCNA
CODESYSControl for IOT2000 SL3.0.0.0 to before 4.8.0.04.8.0.0Patch availableCNA
CODESYSControl for Linux SL3.0.0.0 to before 4.8.0.04.8.0.0Patch availableCNA
CODESYS Control for PFC100 SL3.0.0.0 to before 4.8.0.04.8.0.0Patch availableCNA
CODESYS Control for PFC200 SL3.0.0.0 to before 4.8.0.04.8.0.0Patch availableCNA
CODESYSControl for PLCnext SL3.0.0.0 to before 4.8.0.04.8.0.0Patch availableCNA
CODESYSControl for Raspberry Pi SL3.0.0.0 to before 4.8.0.04.8.0.0Patch availableCNA
CODESYSControl for WAGO Touch Panels 600 SL3.0.0.0 to before 4.8.0.04.8.0.0Patch availableCNA
  • Control RTE (SL) VendorCODESYS Affected 3.0.0.0 to before 3.5.19.0 Fixed in 3.5.19.0 Patch available CNA
  • Control RTE (for Beckhoff CX) SL VendorCODESYS Affected 3.0.0.0 to before 3.5.19.0 Fixed in 3.5.19.0 Patch available CNA
  • Control Win (SL) VendorCODESYS Affected 3.0.0.0 to before 3.5.19.0 Fixed in 3.5.19.0 Patch available CNA
  • Runtime Toolkit VendorCODESYS Affected 3.0.0.0 to before 3.5.19.0 Fixed in 3.5.19.0 Patch available CNA
  • Safety SIL2 Runtime Toolkit VendorCODESYS Affected 3.0.0.0 to before 3.5.19.0 Fixed in 3.5.19.0 Patch available CNA
  • Safety SIL2 PSP VendorCODESYS Affected 3.0.0.0 to before 3.5.19.0 Fixed in 3.5.19.0 Patch available CNA
  • HMI (SL) VendorCODESYS Affected 3.0.0.0 to before 3.5.19.0 Fixed in 3.5.19.0 Patch available CNA
  • Development System V3 VendorCODESYS Affected 3.0.0.0 to before 3.5.19.0 Fixed in 3.5.19.0 Patch available CNA
  • Control for BeagleBone SL VendorCODESYS Affected 3.0.0.0 to before 4.8.0.0 Fixed in 4.8.0.0 Patch available CNA
  • Control for emPC-A/iMX6 SL VendorCODESYS Affected 3.0.0.0 to before 4.8.0.0 Fixed in 4.8.0.0 Patch available CNA
  • Control for IOT2000 SL VendorCODESYS Affected 3.0.0.0 to before 4.8.0.0 Fixed in 4.8.0.0 Patch available CNA
  • Control for Linux SL VendorCODESYS Affected 3.0.0.0 to before 4.8.0.0 Fixed in 4.8.0.0 Patch available CNA
  • Control for PFC100 SL VendorCODESYS Affected 3.0.0.0 to before 4.8.0.0 Fixed in 4.8.0.0 Patch available CNA
  • Control for PFC200 SL VendorCODESYS Affected 3.0.0.0 to before 4.8.0.0 Fixed in 4.8.0.0 Patch available CNA
  • Control for PLCnext SL VendorCODESYS Affected 3.0.0.0 to before 4.8.0.0 Fixed in 4.8.0.0 Patch available CNA
  • Control for Raspberry Pi SL VendorCODESYS Affected 3.0.0.0 to before 4.8.0.0 Fixed in 4.8.0.0 Patch available CNA
  • Control for WAGO Touch Panels 600 SL VendorCODESYS Affected 3.0.0.0 to before 4.8.0.0 Fixed in 4.8.0.0 Patch available CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:*3.0 to before 4.8.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:*3.0 to before 4.8.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*3.0 to before 4.8.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*3.0 to before 4.8.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:*3.0 to before 4.8.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*3.0 to before 4.8.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:*3.0 to before 4.8.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*3.0 to before 4.8.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:*3.0 to before 4.8.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:*3.0 to before 3.5.19.0VulnerableCODESYS
  • cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:* Versions 3.0 to before 4.8.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:* Versions 3.0 to before 4.8.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:* Versions 3.0 to before 4.8.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:* Versions 3.0 to before 4.8.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:* Versions 3.0 to before 4.8.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:* Versions 3.0 to before 4.8.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:* Versions 3.0 to before 4.8.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:* Versions 3.0 to before 4.8.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:* Versions 3.0 to before 4.8.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:* Versions 3.0 to before 3.5.19.0 Vulnerable ·CODESYS
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\):*:*:*:*:*:*:*:*3.0 to before 3.5.19.0VulnerableCODESYS
cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:*3.0 to before 3.5.19.0VulnerableCODESYS
cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*3.0 to before 3.5.19.0VulnerableCODESYS
cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:*3.0 to before 3.5.19.0VulnerableCODESYS
cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:*:*3.0 to before 3.5.19.0VulnerableCODESYS
cpe:2.3:a:codesys:safety_sil2:*:*:*:*:*:*:*:*3.0 to before 3.5.19.0VulnerableCODESYS
  • cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\):*:*:*:*:*:*:*:* Versions 3.0 to before 3.5.19.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:* Versions 3.0 to before 3.5.19.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:* Versions 3.0 to before 3.5.19.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:* Versions 3.0 to before 3.5.19.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:*:* Versions 3.0 to before 3.5.19.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:safety_sil2:*:*:*:*:*:*:*:* Versions 3.0 to before 3.5.19.0 Vulnerable ·CODESYS

Remediation

  • Fix · CNA Control RTE (SL) (CODESYS) Fixed in 3.5.19.0
  • Fix · CNA Control RTE (for Beckhoff CX) SL (CODESYS) Fixed in 3.5.19.0
  • Fix · CNA Control Win (SL) (CODESYS) Fixed in 3.5.19.0
  • Fix · CNA Runtime Toolkit (CODESYS) Fixed in 3.5.19.0
  • Fix · CNA Safety SIL2 Runtime Toolkit (CODESYS) Fixed in 3.5.19.0
  • Fix · CNA Safety SIL2 PSP (CODESYS) Fixed in 3.5.19.0
  • Fix · CNA HMI (SL) (CODESYS) Fixed in 3.5.19.0
  • Fix · CNA Development System V3 (CODESYS) Fixed in 3.5.19.0
  • Fix · CNA Control for BeagleBone SL (CODESYS) Fixed in 4.8.0.0
  • Fix · CNA Control for emPC-A/iMX6 SL (CODESYS) Fixed in 4.8.0.0
  • Fix · CNA Control for IOT2000 SL (CODESYS) Fixed in 4.8.0.0
  • Fix · CNA Control for Linux SL (CODESYS) Fixed in 4.8.0.0
  • Fix · CNA Control for PFC100 SL (CODESYS) Fixed in 4.8.0.0
  • Fix · CNA Control for PFC200 SL (CODESYS) Fixed in 4.8.0.0
  • Fix · CNA Control for PLCnext SL (CODESYS) Fixed in 4.8.0.0
  • Fix · CNA Control for Raspberry Pi SL (CODESYS) Fixed in 4.8.0.0
  • Fix · CNA Control for WAGO Touch Panels 600 SL (CODESYS) Fixed in 4.8.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-4224
  2. 2026-10-03 Alias added: GHSA-p8q2-j5x8-g597

References

Advisory 1

  • TI-2019-06497 An issue was discovered in 3S-Smart CODESYS V3 products. CVSS 3.1CRITICAL 9.8
  • TI-2018-07501 Improper access control in 3S-Smart Software Solutions GmbH CODESYS Control V3 products… CVSS 3.0CRITICAL 9.8
  • TI-2022-23467 CODESYS: Multiple products prone to out-of-bounds write CVSS 3.1HIGH 8.8
  • TI-2022-23479 CODESYS: Multiple products prone to Improper Input Validation CVSS 3.1HIGH 7.5
  • TI-2022-23478 CODESYS: Multiple products prone to stack based out-of-bounds write CVSS 3.1HIGH 8.8
  • TI-2022-23477 CODESYS: Multiple products prone to stack based out-of-bounds write CVSS 3.1HIGH 8.8
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences