Read the docs
TI-2022-06792 Aliases CVE-2022-22516GHSA-wg22-wcgm-8m72

CODESYS driver SysDrv3S allows SYSTEM users on Microsoft Windows to read and write in restricted memory space.

Priority LOW 34CWE-732Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space.

Why it matters now

EPSS 0.00263 18th percentileScored 2026-11-07
Fix Fixed CODESYS Control RTE (SL) (CODESYS): V3.5.18.0CODESYS Control RTE (for Beckhoff CX) SL (CODESYS): V3.5.18.0+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CODESYSCODESYS Control RTE (SL)V3.5.18.0 to before V3.5.18.0V3.5.18.0Patch availableCNA
CODESYSCODESYS Control RTE (for Beckhoff CX) SLV3.5.18.0 to before V3.5.18.0V3.5.18.0Patch availableCNA
CODESYSCODESYS Control Win (SL)V3.5.18.0 to before V3.5.18.0V3.5.18.0Patch availableCNA
CODESYSCODESYS Development System V3V3.5.18.0 to before V3.5.18.0V3.5.18.0Patch availableCNA
  • CODESYS Control RTE (SL) VendorCODESYS Affected V3.5.18.0 to before V3.5.18.0 Fixed in V3.5.18.0 Patch available CNA
  • CODESYS Control RTE (for Beckhoff CX) SL VendorCODESYS Affected V3.5.18.0 to before V3.5.18.0 Fixed in V3.5.18.0 Patch available CNA
  • CODESYS Control Win (SL) VendorCODESYS Affected V3.5.18.0 to before V3.5.18.0 Fixed in V3.5.18.0 Patch available CNA
  • CODESYS Development System V3 VendorCODESYS Affected V3.5.18.0 to before V3.5.18.0 Fixed in V3.5.18.0 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:*before 3.5.18.0VulnerableCODESYS
cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\):*:*:*:*:*:*:*:*before 3.5.18.0VulnerableCODESYS
cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:*before 3.5.18.0VulnerableCODESYS
cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*before 3.5.18.0VulnerableCODESYS
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:* Versions before 3.5.18.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\):*:*:*:*:*:*:*:* Versions before 3.5.18.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:* Versions before 3.5.18.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:* Versions before 3.5.18.0 Vulnerable ·CODESYS
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA CODESYS Control RTE (SL) (CODESYS) Fixed in V3.5.18.0
  • Fix · CNA CODESYS Control RTE (for Beckhoff CX) SL (CODESYS) Fixed in V3.5.18.0
  • Fix · CNA CODESYS Control Win (SL) (CODESYS) Fixed in V3.5.18.0
  • Fix · CNA CODESYS Development System V3 (CODESYS) Fixed in V3.5.18.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    CODESYS Control RTE (SL), CODESYS Control RTE (for Beckhoff CX) SL, CODESYS Control Win (SL) V3.5.18.0

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2022-06795 Special HTTP(s) Requests can cause a buffer-read causing a crash of the webserver and the runtime system.Priority LOW 36
    • TI-2022-06793 Communication Components in multiple CODESYS products vulnerable to communication channel disruptionPriority LOW 36
    • TI-2022-06790 Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS.Priority LOW 33
    Show all 5 records →
  • Release ·

    CODESYS Development System V3 V3.5.18.0

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2022-06793 Communication Components in multiple CODESYS products vulnerable to communication channel disruptionPriority LOW 36
    • TI-2022-06790 Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS.Priority LOW 33
    • TI-2022-06789 Null Pointer Dereference in multiple CODESYS products can lead to a DoS.Priority LOW 31
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22516
  2. 2026-10-03 Alias added: GHSA-wg22-wcgm-8m72

References

Advisory 1

  • TI-2018-07501 Improper access control in 3S-Smart Software Solutions GmbH CODESYS Control V3 products… CVSS 3.0CRITICAL 9.8
  • TI-2022-03868 CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3 CVSS 3.1HIGH 8.8
  • TI-2022-03712 CODESYS: Improper memory restrictions fro CODESYS Control CVSS 3.1HIGH 8.8
  • TI-2025-27700 CODESYS Control - Invalid type usage in visualization CVSS 3.1HIGH 7.5
  • TI-2018-14204 Improper Communication Address Filtering exists in CODESYS V3 products versions prior V3.5.14.0. CVSS 3.1HIGH 7.5
  • TI-2022-06791 A component of the CODESYS Control runtime system allows read and write access to configuration files CVSS 3.1HIGH 8.1
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences