Read the docs
TI-2022-12920 Aliases CVE-2022-30791GHSA-cxc2-v3v8-ggcp

CODESYS V3: CmpBlkDrvTcp allows unauthenticated attackers to block all its available TCP connections

Priority LOW 35CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing connections are not affected.

Why it matters now

EPSS 0.00894 59th percentileScored 2026-11-07
Fix Fixed CODESYS Control RTE (SL) (CODESYS): V3.5.18.20CODESYS Control RTE (for Beckhoff CX) SL (CODESYS): V3.5.18.20+19 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CODESYSCODESYS Control RTE (SL)V3 to before V3.5.18.20V3.5.18.20Patch availableCNA
CODESYSCODESYS Control RTE (for Beckhoff CX) SLV3 to before V3.5.18.20V3.5.18.20Patch availableCNA
CODESYSCODESYS Control Win (SL)V3 to before V3.5.18.20V3.5.18.20Patch availableCNA
CODESYSCODESYS GatewayV3 to before V3.5.18.20V3.5.18.20Patch availableCNA
CODESYSCODESYS Edge Gateway for WindowsV3 to before V3.5.18.20V3.5.18.20Patch availableCNA
CODESYSCODESYS HMI (SL)V3 to before V3.5.18.20V3.5.18.20Patch availableCNA
CODESYSCODESYS Development System V3V3 to before V3.5.18.10V3.5.18.10Patch availableCNA
CODESYSCODESYS Control Runtime System ToolkitV3 to before V3.5.18.20V3.5.18.20Patch availableCNA
CODESYSCODESYS Embedded Target Visu ToolkitV3 to before V3.5.18.20V3.5.18.20Patch availableCNA
CODESYSCODESYS Remote Target Visu ToolkitV3 to before V3.5.18.20V3.5.18.20Patch availableCNA
CODESYSCODESYS Control for BeagleBone SLV3 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for Beckhoff CX9020 SLV3 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for emPC-A/iMX6 SLV3 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for IOT2000 SLV3 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for Linux SLV3 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for PFC100 SLV3 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for PFC200 SLV3 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for PLCnext SLV3 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for Raspberry Pi SLV3 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Control for WAGO Touch Panels 600 SLV3 to before V4.5.0.0V4.5.0.0Patch availableCNA
CODESYSCODESYS Edge Gateway for LinuxV3 to before V4.5.0.0V4.5.0.0Patch availableCNA
  • CODESYS Control RTE (SL) VendorCODESYS Affected V3 to before V3.5.18.20 Fixed in V3.5.18.20 Patch available CNA
  • CODESYS Control RTE (for Beckhoff CX) SL VendorCODESYS Affected V3 to before V3.5.18.20 Fixed in V3.5.18.20 Patch available CNA
  • CODESYS Control Win (SL) VendorCODESYS Affected V3 to before V3.5.18.20 Fixed in V3.5.18.20 Patch available CNA
  • CODESYS Gateway VendorCODESYS Affected V3 to before V3.5.18.20 Fixed in V3.5.18.20 Patch available CNA
  • CODESYS Edge Gateway for Windows VendorCODESYS Affected V3 to before V3.5.18.20 Fixed in V3.5.18.20 Patch available CNA
  • CODESYS HMI (SL) VendorCODESYS Affected V3 to before V3.5.18.20 Fixed in V3.5.18.20 Patch available CNA
  • CODESYS Development System V3 VendorCODESYS Affected V3 to before V3.5.18.10 Fixed in V3.5.18.10 Patch available CNA
  • CODESYS Control Runtime System Toolkit VendorCODESYS Affected V3 to before V3.5.18.20 Fixed in V3.5.18.20 Patch available CNA
  • CODESYS Embedded Target Visu Toolkit VendorCODESYS Affected V3 to before V3.5.18.20 Fixed in V3.5.18.20 Patch available CNA
  • CODESYS Remote Target Visu Toolkit VendorCODESYS Affected V3 to before V3.5.18.20 Fixed in V3.5.18.20 Patch available CNA
  • CODESYS Control for BeagleBone SL VendorCODESYS Affected V3 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for Beckhoff CX9020 SL VendorCODESYS Affected V3 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for emPC-A/iMX6 SL VendorCODESYS Affected V3 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for IOT2000 SL VendorCODESYS Affected V3 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for Linux SL VendorCODESYS Affected V3 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for PFC100 SL VendorCODESYS Affected V3 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for PFC200 SL VendorCODESYS Affected V3 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for PLCnext SL VendorCODESYS Affected V3 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for Raspberry Pi SL VendorCODESYS Affected V3 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Control for WAGO Touch Panels 600 SL VendorCODESYS Affected V3 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA
  • CODESYS Edge Gateway for Linux VendorCODESYS Affected V3 to before V4.5.0.0 Fixed in V4.5.0.0 Patch available CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:codesys:control_for_beaglebone:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_empc-a\/imx6:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*before 4.6.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_plcnext:*:*:*:*:*:*:*:*before 4.6.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_wago_touch_panels_600:*:*:*:*:*:*:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:*before 3.5.18.20VulnerableCODESYS
  • cpe:2.3:a:codesys:control_for_beaglebone:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_empc-a\/imx6:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:* Versions before 4.6.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_plcnext:*:*:*:*:*:*:*:* Versions before 4.6.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_wago_touch_panels_600:*:*:*:*:*:*:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:* Versions before 3.5.18.20 Vulnerable ·CODESYS
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\):*:*:*:*:*:*:*:*before 3.5.18.20VulnerableCODESYS
cpe:2.3:a:codesys:control_runtime_system_toolkit:*:*:*:*:*:*:*:*before 3.5.18.20VulnerableCODESYS
cpe:2.3:a:codesys:control_win:*:*:*:*:*:*:*:*before 3.5.18.20VulnerableCODESYS
cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*before 3.5.18.20VulnerableCODESYS
cpe:2.3:a:codesys:edge_gateway:*:*:*:*:*:windows:*:*before 3.5.18.20VulnerableCODESYS
cpe:2.3:a:codesys:edge_gateway:*:*:*:*:*:linux:*:*before 4.5.0.0VulnerableCODESYS
cpe:2.3:a:codesys:embedded_target_visu_toolkit:*:*:*:*:*:*:*:*before 3.5.18.20VulnerableCODESYS
cpe:2.3:a:codesys:gateway:*:*:*:*:*:*:*:*before 3.5.18.20VulnerableCODESYS
cpe:2.3:a:codesys:hmi:*:*:*:*:*:*:*:*before 3.5.18.20VulnerableCODESYS
cpe:2.3:a:codesys:remote_target_visu_toolkit:*:*:*:*:*:*:*:*before 3.5.18.20VulnerableCODESYS
  • cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\):*:*:*:*:*:*:*:* Versions before 3.5.18.20 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_runtime_system_toolkit:*:*:*:*:*:*:*:* Versions before 3.5.18.20 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_win:*:*:*:*:*:*:*:* Versions before 3.5.18.20 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:* Versions before 3.5.18.20 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:edge_gateway:*:*:*:*:*:windows:*:* Versions before 3.5.18.20 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:edge_gateway:*:*:*:*:*:linux:*:* Versions before 4.5.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:embedded_target_visu_toolkit:*:*:*:*:*:*:*:* Versions before 3.5.18.20 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:gateway:*:*:*:*:*:*:*:* Versions before 3.5.18.20 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:hmi:*:*:*:*:*:*:*:* Versions before 3.5.18.20 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:remote_target_visu_toolkit:*:*:*:*:*:*:*:* Versions before 3.5.18.20 Vulnerable ·CODESYS

Remediation

  • Fix · CNA CODESYS Control RTE (SL) (CODESYS) Fixed in V3.5.18.20
  • Fix · CNA CODESYS Control RTE (for Beckhoff CX) SL (CODESYS) Fixed in V3.5.18.20
  • Fix · CNA CODESYS Control Win (SL) (CODESYS) Fixed in V3.5.18.20
  • Fix · CNA CODESYS Gateway (CODESYS) Fixed in V3.5.18.20
  • Fix · CNA CODESYS Edge Gateway for Windows (CODESYS) Fixed in V3.5.18.20
  • Fix · CNA CODESYS HMI (SL) (CODESYS) Fixed in V3.5.18.20
  • Fix · CNA CODESYS Development System V3 (CODESYS) Fixed in V3.5.18.10
  • Fix · CNA CODESYS Control Runtime System Toolkit (CODESYS) Fixed in V3.5.18.20
  • Fix · CNA CODESYS Embedded Target Visu Toolkit (CODESYS) Fixed in V3.5.18.20
  • Fix · CNA CODESYS Remote Target Visu Toolkit (CODESYS) Fixed in V3.5.18.20
  • Fix · CNA CODESYS Control for BeagleBone SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for Beckhoff CX9020 SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for emPC-A/iMX6 SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for IOT2000 SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for Linux SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for PFC100 SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for PFC200 SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for PLCnext SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for Raspberry Pi SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Control for WAGO Touch Panels 600 SL (CODESYS) Fixed in V4.5.0.0
  • Fix · CNA CODESYS Edge Gateway for Linux (CODESYS) Fixed in V4.5.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    CODESYS Control RTE (SL), CODESYS Control RTE (for Beckhoff CX) SL and 19 more products V3.5.18.10, V3.5.18.20, V4.5.0.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-12921 Uncontrolled resource consumption in CODESYS Control RTEPriority LOW 35
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-30791
  2. 2026-10-03 Alias added: GHSA-cxc2-v3v8-ggcp

References

Advisory 1

  • TI-2019-10180 Stack-based buffer overflow in CODESYS V3 web server CVSS 3.1CRITICAL 9.8
  • TI-2020-08257 CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. CVSS 3.1CRITICAL 9.8
  • TI-2019-13592 CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. CVSS 3.1CRITICAL 9.8
  • TI-2019-06495 An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. CVSS 3.1HIGH 8.8
  • TI-2018-15275 Codesys Runtime Improper Limitation of a Pathname CVSS 3.1HIGH 8.8
  • TI-2019-10164 Path traversal in CODESYS V3 web server CVSS 3.1HIGH 7.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences