Read the docs
TI-2022-13697 Aliases CVE-2022-31805GHSA-q837-53gv-8r7r

Insecure transmission of credentials in CODESYS Development System

Priority LOW 35CWE-523Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.

Why it matters now

EPSS 0.01046 64th percentileScored 2026-11-07
Fix Fixed CODESYS Development System (CODESYS): V2.3.9.69, V3.5.18.30CODESYS Gateway Client (CODESYS): V2.3.9.38+10 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CODESYSCODESYS Development SystemV2 to before V2.3.9.69; V3 to before V3.5.18.30V2.3.9.69, V3.5.18.30Patch availableCNA
CODESYSCODESYS Gateway ClientV2 to before V2.3.9.38V2.3.9.38Patch availableCNA
CODESYSCODESYS Gateway ServerV2 to before V2.3.9.38V2.3.9.38Patch availableCNA
CODESYSCODESYS Web serverV1 to before V1.1.9.23V1.1.9.23Patch availableCNA
CODESYSCODESYS SP Realtime NTV2 to before V2.3.7.30V2.3.7.30Patch availableCNA
CODESYSCODESYS PLCWinNTV2 to before V2.4.7.57V2.4.7.57Patch availableCNA
CODESYSCODESYS Runtime Toolkit 32 bit fullV2 to before V2.4.7.57V2.4.7.57Patch availableCNA
CODESYSCODESYS Edge Gateway for WindowsV3 to before V3.5.18.30V3.5.18.30Patch availableCNA
CODESYSCODESYS HMI (SL)V3 to before V3.5.18.30V3.5.18.30Patch availableCNA
CODESYSCODESYS OPC DA Server SLV3 to before V3.5.18.30V3.5.18.30Patch availableCNA
CODESYSCODESYS PLCHandlerV3 to before V3.5.18.30V3.5.18.30Patch availableCNA
CODESYSCODESYS GatewayV3 to before V3.5.18.30V3.5.18.30Patch availableCNA
  • CODESYS Development System VendorCODESYS Affected V2 to before V2.3.9.69; V3 to before V3.5.18.30 Fixed in V2.3.9.69, V3.5.18.30 Patch available CNA
  • CODESYS Gateway Client VendorCODESYS Affected V2 to before V2.3.9.38 Fixed in V2.3.9.38 Patch available CNA
  • CODESYS Gateway Server VendorCODESYS Affected V2 to before V2.3.9.38 Fixed in V2.3.9.38 Patch available CNA
  • CODESYS Web server VendorCODESYS Affected V1 to before V1.1.9.23 Fixed in V1.1.9.23 Patch available CNA
  • CODESYS SP Realtime NT VendorCODESYS Affected V2 to before V2.3.7.30 Fixed in V2.3.7.30 Patch available CNA
  • CODESYS PLCWinNT VendorCODESYS Affected V2 to before V2.4.7.57 Fixed in V2.4.7.57 Patch available CNA
  • CODESYS Runtime Toolkit 32 bit full VendorCODESYS Affected V2 to before V2.4.7.57 Fixed in V2.4.7.57 Patch available CNA
  • CODESYS Edge Gateway for Windows VendorCODESYS Affected V3 to before V3.5.18.30 Fixed in V3.5.18.30 Patch available CNA
  • CODESYS HMI (SL) VendorCODESYS Affected V3 to before V3.5.18.30 Fixed in V3.5.18.30 Patch available CNA
  • CODESYS OPC DA Server SL VendorCODESYS Affected V3 to before V3.5.18.30 Fixed in V3.5.18.30 Patch available CNA
  • CODESYS PLCHandler VendorCODESYS Affected V3 to before V3.5.18.30 Fixed in V3.5.18.30 Patch available CNA
  • CODESYS Gateway VendorCODESYS Affected V3 to before V3.5.18.30 Fixed in V3.5.18.30 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*before 2.3.9.69VulnerableCODESYS
cpe:2.3:a:codesys:edge_gateway:*:*:*:*:*:windows:*:*before 3.5.18.30VulnerableCODESYS
cpe:2.3:a:codesys:gateway:*:*:*:*:*:*:*:*before 2.3.9.38VulnerableCODESYS
cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:*before 3.5.18.30VulnerableCODESYS
cpe:2.3:a:codesys:opc_server:*:*:*:*:*:*:*:*before 3.5.18.30VulnerableCODESYS
cpe:2.3:a:codesys:plchandler:*:*:*:*:*:*:*:*before 3.5.18.30VulnerableCODESYS
cpe:2.3:a:codesys:plcwinnt:*:*:*:*:*:*:*:*before 2.4.7.57VulnerableCODESYS
cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:x86:*before 2.4.7.57VulnerableCODESYS
cpe:2.3:a:codesys:sp_realtime_nt:*:*:*:*:*:*:*:*before 2.3.7.30VulnerableCODESYS
cpe:2.3:a:codesys:web_server:*:*:*:*:*:*:*:*before 1.1.9.23VulnerableCODESYS
  • cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:* Versions before 2.3.9.69 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:edge_gateway:*:*:*:*:*:windows:*:* Versions before 3.5.18.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:gateway:*:*:*:*:*:*:*:* Versions before 2.3.9.38 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:* Versions before 3.5.18.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:opc_server:*:*:*:*:*:*:*:* Versions before 3.5.18.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:plchandler:*:*:*:*:*:*:*:* Versions before 3.5.18.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:plcwinnt:*:*:*:*:*:*:*:* Versions before 2.4.7.57 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:x86:* Versions before 2.4.7.57 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:sp_realtime_nt:*:*:*:*:*:*:*:* Versions before 2.3.7.30 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:web_server:*:*:*:*:*:*:*:* Versions before 1.1.9.23 Vulnerable ·CODESYS

Remediation

  • Fix · CNA CODESYS Development System (CODESYS) Fixed in V2.3.9.69, V3.5.18.30
  • Fix · CNA CODESYS Gateway Client (CODESYS) Fixed in V2.3.9.38
  • Fix · CNA CODESYS Gateway Server (CODESYS) Fixed in V2.3.9.38
  • Fix · CNA CODESYS Web server (CODESYS) Fixed in V1.1.9.23
  • Fix · CNA CODESYS SP Realtime NT (CODESYS) Fixed in V2.3.7.30
  • Fix · CNA CODESYS PLCWinNT (CODESYS) Fixed in V2.4.7.57
  • Fix · CNA CODESYS Runtime Toolkit 32 bit full (CODESYS) Fixed in V2.4.7.57
  • Fix · CNA CODESYS Edge Gateway for Windows (CODESYS) Fixed in V3.5.18.30
  • Fix · CNA CODESYS HMI (SL) (CODESYS) Fixed in V3.5.18.30
  • Fix · CNA CODESYS OPC DA Server SL (CODESYS) Fixed in V3.5.18.30
  • Fix · CNA CODESYS PLCHandler (CODESYS) Fixed in V3.5.18.30
  • Fix · CNA CODESYS Gateway (CODESYS) Fixed in V3.5.18.30

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    CODESYS PLCWinNT, CODESYS Runtime Toolkit 32 bit full V2.4.7.57

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-13698 Insecure default settings in CODESYS Runtime Toolkit 32 bit full and CODESYS PLCWinNTPriority MEDIUM 45
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31805
  2. 2026-10-03 Alias added: GHSA-q837-53gv-8r7r

References

Advisory 1

  • TI-2019-06497 An issue was discovered in 3S-Smart CODESYS V3 products. CVSS 3.1CRITICAL 9.8
  • TI-2023-03420 CODESYS: Missing integrity check in CODESYS Development System CVSS 3.1HIGH 8.8
  • TI-2022-03868 CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3 CVSS 3.1HIGH 8.8
  • TI-2021-10055 CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS). CVSS 3.1HIGH 7.5
  • TI-2026-32408 Incorrect Default Permissions in CODESYS Development System CVSS 4.0HIGH 8.5
  • TI-2026-32407 Incorrect Default Permissions in CODESYS Development System CVSS 4.0HIGH 8.5
See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences