Read the docs
TI-2022-13695 Aliases CVE-2022-31803GHSA-9348-vpwc-ch78

CODESYS Gateway Server V2 prone to Denial of Service Attack

Priority LOW 26CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP connections and prevent legitimate users or clients from establishing a new connection to the CODESYS Gateway Server V2. Existing connections are not affected and therefore remain intact.

Why it matters now

EPSS 0.01163 67th percentileScored 2026-11-07
Fix Fixed CODESYS Gateway Server V2 (CODESYS): V2.3.9.38

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CODESYSCODESYS Gateway Server V2V2 to before V2.3.9.38V2.3.9.38Patch availableCNA
  • CODESYS Gateway Server V2 VendorCODESYS Affected V2 to before V2.3.9.38 Fixed in V2.3.9.38 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:codesys:gateway:*:*:*:*:*:*:*:*2.0 to before 2.3.9.38VulnerableCODESYS
  • cpe:2.3:a:codesys:gateway:*:*:*:*:*:*:*:* Versions 2.0 to before 2.3.9.38 Vulnerable ·CODESYS

Remediation

  • Fix · CNA CODESYS Gateway Server V2 (CODESYS) Fixed in V2.3.9.38

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    CODESYS Gateway Server V2 V2.3.9.38

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2022-13694 Partial string comparison in CODESYS gateway serverPriority MEDIUM 45
    • TI-2022-13696 CODESYS Gateway server prone to denial of service attack due to excessive memory allocationPriority LOW 35
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31803
  2. 2026-10-03 Alias added: GHSA-9348-vpwc-ch78

References

Advisory 1

  • TI-2019-06497 An issue was discovered in 3S-Smart CODESYS V3 products. CVSS 3.1CRITICAL 9.8
  • TI-2022-13694 Partial string comparison in CODESYS gateway server CVSS 3.1CRITICAL 9.8
  • TI-2021-10055 CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS). CVSS 3.1HIGH 7.5
  • TI-2018-14204 Improper Communication Address Filtering exists in CODESYS V3 products versions prior V3.5.14.0. CVSS 3.1HIGH 7.5
  • TI-2018-14203 Use of Insufficiently Random Values exists in CODESYS V3 products versions prior V3.5.14.0. CVSS 3.0HIGH 7.5
  • TI-2019-06499 An issue was discovered in 3S-Smart CODESYS V3 products. CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences