Read the docs
TI-2022-06795 Aliases CVE-2022-22519GHSA-cx43-qj46-j7wr

Special HTTP(s) Requests can cause a buffer-read causing a crash of the webserver and the runtime system.

Priority LOW 36CWE-126Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-126 and the CVSS impact.

Summary

A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system.

Why it matters now

EPSS 0.01682 77th percentileScored 2026-11-07
Fix Fixed CODESYS Control RTE (SL) (CODESYS): V3.5.18.0CODESYS Control RTE (for Beckhoff CX) SL (CODESYS): V3.5.18.0+15 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CODESYSCODESYS Control RTE (SL)V3.5.18.0 to before V3.5.18.0V3.5.18.0Patch availableCNA
CODESYSCODESYS Control RTE (for Beckhoff CX) SLV3.5.18.0 to before V3.5.18.0V3.5.18.0Patch availableCNA
CODESYSCODESYS Control Win (SL)V3.5.18.0 to before V3.5.18.0V3.5.18.0Patch availableCNA
CODESYSCODESYS HMI (SL)V3.5.18.0 to before V3.5.18.0V3.5.18.0Patch availableCNA
CODESYSCODESYS Control Runtime System ToolkitV3.5.18.0 to before V3.5.18.0V3.5.18.0Patch availableCNA
CODESYSCODESYS Embedded Target Visu ToolkitV3.5.18.0 to before V3.5.18.0V3.5.18.0Patch availableCNA
CODESYSCODESYS Remote Target Visu ToolkitV3.5.18.0 to before V3.5.18.0V3.5.18.0Patch availableCNA
CODESYSCODESYS Control for BeagleBone SLV4.5.0.0 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for Beckhoff CX9020 SLV4.5.0.0 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for emPC-A/iMX6 SLV4.5.0.0 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for IOT2000 SLV4.5.0.0 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for Linux SLV4.5.0.0 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for PFC100 SLV4.5.0.0 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for PFC200 SLV4.5.0.0 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for PLCnext SLV4.5.0.0 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for Raspberry Pi SLV4.5.0.0 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for WAGO Touch Panels 600 SLV4.5.0.0 to before V4.5.0.0V4.5.0.0Patch availableCNA
  • CODESYS Control RTE (SL) VendorCODESYS Affected V3.5.18.0 to before V3.5.18.0 Fixed in V3.5.18.0 Patch available CNA
  • CODESYS Control RTE (for Beckhoff CX) SL VendorCODESYS Affected V3.5.18.0 to before V3.5.18.0 Fixed in V3.5.18.0 Patch available CNA
  • CODESYS Control Win (SL) VendorCODESYS Affected V3.5.18.0 to before V3.5.18.0 Fixed in V3.5.18.0 Patch available CNA
  • CODESYS HMI (SL) VendorCODESYS Affected V3.5.18.0 to before V3.5.18.0 Fixed in V3.5.18.0 Patch available CNA
  • CODESYS Control Runtime System Toolkit VendorCODESYS Affected V3.5.18.0 to before V3.5.18.0 Fixed in V3.5.18.0 Patch available CNA
  • CODESYS Embedded Target Visu Toolkit VendorCODESYS Affected V3.5.18.0 to before V3.5.18.0 Fixed in V3.5.18.0 Patch available CNA
  • CODESYS Remote Target Visu Toolkit VendorCODESYS Affected V3.5.18.0 to before V3.5.18.0 Fixed in V3.5.18.0 Patch available CNA
  • CODESYS Control for BeagleBone SL VendorCODESYS Affected V4.5.0.0 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for Beckhoff CX9020 SL VendorCODESYS Affected V4.5.0.0 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for emPC-A/iMX6 SL VendorCODESYS Affected V4.5.0.0 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for IOT2000 SL VendorCODESYS Affected V4.5.0.0 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for Linux SL VendorCODESYS Affected V4.5.0.0 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for PFC100 SL VendorCODESYS Affected V4.5.0.0 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for PFC200 SL VendorCODESYS Affected V4.5.0.0 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for PLCnext SL VendorCODESYS Affected V4.5.0.0 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for Raspberry Pi SL VendorCODESYS Affected V4.5.0.0 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for WAGO Touch Panels 600 SL VendorCODESYS Affected V4.5.0.0 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_beckhoff_cx9020:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
  • cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_beckhoff_cx9020:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:*before 3.5.18.0VulnerableCODESYS
cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\):*:*:*:*:*:*:*:*before 3.5.18.0VulnerableCODESYS
cpe:2.3:a:codesys:control_runtime_system_toolkit:*:*:*:*:*:*:*:*before 3.5.18.0VulnerableCODESYS
cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:*before 3.5.18.0VulnerableCODESYS
cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*before 3.5.18.0VulnerableCODESYS
cpe:2.3:a:codesys:embedded_target_visu_toolkit:*:*:*:*:*:*:*:*before 3.5.18.0VulnerableCODESYS
cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:*before 3.5.18.0VulnerableCODESYS
cpe:2.3:a:codesys:remote_target_visu_toolkit:*:*:*:*:*:*:*:*before 3.5.18.0VulnerableCODESYS
  • cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:* Versions before 3.5.18.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\):*:*:*:*:*:*:*:* Versions before 3.5.18.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_runtime_system_toolkit:*:*:*:*:*:*:*:* Versions before 3.5.18.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:* Versions before 3.5.18.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:* Versions before 3.5.18.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:embedded_target_visu_toolkit:*:*:*:*:*:*:*:* Versions before 3.5.18.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:* Versions before 3.5.18.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:remote_target_visu_toolkit:*:*:*:*:*:*:*:* Versions before 3.5.18.0 Vulnerable ·CODESYS

Remediation

  • Fix · CNA CODESYS Control RTE (SL) (CODESYS) Fixed in V3.5.18.0
  • Fix · CNA CODESYS Control RTE (for Beckhoff CX) SL (CODESYS) Fixed in V3.5.18.0
  • Fix · CNA CODESYS Control Win (SL) (CODESYS) Fixed in V3.5.18.0
  • Fix · CNA CODESYS HMI (SL) (CODESYS) Fixed in V3.5.18.0
  • Fix · CNA CODESYS Control Runtime System Toolkit (CODESYS) Fixed in V3.5.18.0
  • Fix · CNA CODESYS Embedded Target Visu Toolkit (CODESYS) Fixed in V3.5.18.0
  • Fix · CNA CODESYS Remote Target Visu Toolkit (CODESYS) Fixed in V3.5.18.0
  • Fix · CNA CODESYS Control for BeagleBone SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for Beckhoff CX9020 SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for emPC-A/iMX6 SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for IOT2000 SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for Linux SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for PFC100 SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for PFC200 SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for PLCnext SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for Raspberry Pi SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for WAGO Touch Panels 600 SL (CODESYS) Fixed in V4.5.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    CODESYS Control for BeagleBone SL, CODESYS Control for Beckhoff CX9020 SL and 7 more products V4.5.0.0

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2022-06791 A component of the CODESYS Control runtime system allows read and write access to configuration filesPriority LOW 38
    • TI-2022-06793 Communication Components in multiple CODESYS products vulnerable to communication channel disruptionPriority LOW 36
    • TI-2022-06790 Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS.Priority LOW 33
    Show all 6 records →
  • Release ·

    CODESYS Control Runtime System Toolkit V3.5.18.0

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2022-06793 Communication Components in multiple CODESYS products vulnerable to communication channel disruptionPriority LOW 36
    • TI-2022-06790 Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS.Priority LOW 33
    • TI-2022-06789 Null Pointer Dereference in multiple CODESYS products can lead to a DoS.Priority LOW 31
    Show all 5 records →
Show 3 more groups
  • Release ·

    CODESYS Control for PLCnext SL V4.5.0.0

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2022-06791 A component of the CODESYS Control runtime system allows read and write access to configuration filesPriority LOW 38
    • TI-2022-06793 Communication Components in multiple CODESYS products vulnerable to communication channel disruptionPriority LOW 36
    • TI-2022-06790 Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS.Priority LOW 33
    Show all 5 records →
  • Release ·

    CODESYS Control RTE (SL), CODESYS Control RTE (for Beckhoff CX) SL, CODESYS Control Win (SL) V3.5.18.0

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2022-06793 Communication Components in multiple CODESYS products vulnerable to communication channel disruptionPriority LOW 36
    • TI-2022-06792 CODESYS driver SysDrv3S allows SYSTEM users on Microsoft Windows to read and write in restricted memory space.Priority LOW 34
    • TI-2022-06790 Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS.Priority LOW 33
    Show all 5 records →
  • Release ·

    CODESYS Embedded Target Visu Toolkit, CODESYS HMI (SL), CODESYS Remote Target Visu Toolkit V3.5.18.0

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2022-06793 Communication Components in multiple CODESYS products vulnerable to communication channel disruptionPriority LOW 36
    • TI-2022-06790 Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS.Priority LOW 33
    • TI-2022-06789 Null Pointer Dereference in multiple CODESYS products can lead to a DoS.Priority LOW 31
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22519
  2. 2026-10-03 Alias added: GHSA-cx43-qj46-j7wr

References

Advisory 1

  • TI-2019-06497 An issue was discovered in 3S-Smart CODESYS V3 products. CVSS 3.1CRITICAL 9.8
  • TI-2018-07501 Improper access control in 3S-Smart Software Solutions GmbH CODESYS Control V3 products… CVSS 3.0CRITICAL 9.8
  • TI-2022-23467 CODESYS: Multiple products prone to out-of-bounds write CVSS 3.1HIGH 8.8
  • TI-2022-23479 CODESYS: Multiple products prone to Improper Input Validation CVSS 3.1HIGH 7.5
  • TI-2022-23478 CODESYS: Multiple products prone to stack based out-of-bounds write CVSS 3.1HIGH 8.8
  • TI-2022-23477 CODESYS: Multiple products prone to stack based out-of-bounds write CVSS 3.1HIGH 8.8
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences