CODESYS: Multiple products prone to stack based out-of-bounds write
Priority MEDIUM 43CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01323 71st percentileScored 2026-11-07
Fix Fixed CODESYS Control RTE (SL) (CODESYS): V3.5.19.0CODESYS Control RTE (for Beckhoff CX) SL (CODESYS): V3.5.19.0+15 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CODESYS | CODESYS Control RTE (SL) | V0.0.0.0 to before V3.5.19.0 | V3.5.19.0 | Patch available | CNA |
| CODESYS | CODESYS Control RTE (for Beckhoff CX) SL | V0.0.0.0 to before V3.5.19.0 | V3.5.19.0 | Patch available | CNA |
| CODESYS | CODESYS Control Win (SL) | V0.0.0.0 to before V3.5.19.0 | V3.5.19.0 | Patch available | CNA |
| CODESYS | CODESYS Control Runtime System Toolkit | V0.0.0.0 to before V3.5.19.0 | V3.5.19.0 | Patch available | CNA |
| CODESYS | CODESYS Safety SIL2 Runtime Toolkit | V0.0.0.0 to before V3.5.19.0 | V3.5.19.0 | Patch available | CNA |
| CODESYS | CODESYS Safety SIL2 PSP | V0.0.0.0 to before V3.5.19.0 | V3.5.19.0 | Patch available | CNA |
| CODESYS | CODESYS HMI (SL) | V0.0.0.0 to before V3.5.19.0 | V3.5.19.0 | Patch available | CNA |
| CODESYS | CODESYS Development System V3 | V0.0.0.0 to before V3.5.19.0 | V3.5.19.0 | Patch available | CNA |
| CODESYS | CODESYS Control for BeagleBone SL | V0.0.0.0 to before V4.8.0.0 | V4.8.0.0 | Patch available | CNA |
| CODESYS | CODESYS Control for emPC-A/iMX6 SL | V0.0.0.0 to before V4.8.0.0 | V4.8.0.0 | Patch available | CNA |
| CODESYS | CODESYS Control for IOT2000 SL | V0.0.0.0 to before V4.8.0.0 | V4.8.0.0 | Patch available | CNA |
| CODESYS | CODESYS Control for Linux SL | V0.0.0.0 to before V4.8.0.0 | V4.8.0.0 | Patch available | CNA |
| CODESYS | CODESYS Control for PFC100 SL | V0.0.0.0 to before V4.8.0.0 | V4.8.0.0 | Patch available | CNA |
| CODESYS | CODESYS Control for PFC200 SL | V0.0.0.0 to before V4.8.0.0 | V4.8.0.0 | Patch available | CNA |
| CODESYS | CODESYS Control for PLCnext SL | V0.0.0.0 to before V4.8.0.0 | V4.8.0.0 | Patch available | CNA |
| CODESYS | CODESYS Control for Raspberry Pi SL | V0.0.0.0 to before V4.8.0.0 | V4.8.0.0 | Patch available | CNA |
| CODESYS | CODESYS Control for WAGO Touch Panels 600 SL | V0.0.0.0 to before V4.8.0.0 | V4.8.0.0 | Patch available | CNA |
- CODESYS Control RTE (SL) VendorCODESYS Affected V0.0.0.0 to before V3.5.19.0 Fixed in V3.5.19.0 Patch available CNA
- CODESYS Control RTE (for Beckhoff CX) SL VendorCODESYS Affected V0.0.0.0 to before V3.5.19.0 Fixed in V3.5.19.0 Patch available CNA
- CODESYS Control Win (SL) VendorCODESYS Affected V0.0.0.0 to before V3.5.19.0 Fixed in V3.5.19.0 Patch available CNA
- CODESYS Control Runtime System Toolkit VendorCODESYS Affected V0.0.0.0 to before V3.5.19.0 Fixed in V3.5.19.0 Patch available CNA
- CODESYS Safety SIL2 Runtime Toolkit VendorCODESYS Affected V0.0.0.0 to before V3.5.19.0 Fixed in V3.5.19.0 Patch available CNA
- CODESYS Safety SIL2 PSP VendorCODESYS Affected V0.0.0.0 to before V3.5.19.0 Fixed in V3.5.19.0 Patch available CNA
- CODESYS HMI (SL) VendorCODESYS Affected V0.0.0.0 to before V3.5.19.0 Fixed in V3.5.19.0 Patch available CNA
- CODESYS Development System V3 VendorCODESYS Affected V0.0.0.0 to before V3.5.19.0 Fixed in V3.5.19.0 Patch available CNA
- CODESYS Control for BeagleBone SL VendorCODESYS Affected V0.0.0.0 to before V4.8.0.0 Fixed in V4.8.0.0 Patch available CNA
- CODESYS Control for emPC-A/iMX6 SL VendorCODESYS Affected V0.0.0.0 to before V4.8.0.0 Fixed in V4.8.0.0 Patch available CNA
- CODESYS Control for IOT2000 SL VendorCODESYS Affected V0.0.0.0 to before V4.8.0.0 Fixed in V4.8.0.0 Patch available CNA
- CODESYS Control for Linux SL VendorCODESYS Affected V0.0.0.0 to before V4.8.0.0 Fixed in V4.8.0.0 Patch available CNA
- CODESYS Control for PFC100 SL VendorCODESYS Affected V0.0.0.0 to before V4.8.0.0 Fixed in V4.8.0.0 Patch available CNA
- CODESYS Control for PFC200 SL VendorCODESYS Affected V0.0.0.0 to before V4.8.0.0 Fixed in V4.8.0.0 Patch available CNA
- CODESYS Control for PLCnext SL VendorCODESYS Affected V0.0.0.0 to before V4.8.0.0 Fixed in V4.8.0.0 Patch available CNA
- CODESYS Control for Raspberry Pi SL VendorCODESYS Affected V0.0.0.0 to before V4.8.0.0 Fixed in V4.8.0.0 Patch available CNA
- CODESYS Control for WAGO Touch Panels 600 SL VendorCODESYS Affected V0.0.0.0 to before V4.8.0.0 Fixed in V4.8.0.0 Patch available CNA
CPE configurations NVD · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:* | before 4.8.0.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:* | before 4.8.0.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:* | before 4.8.0.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:* | before 4.8.0.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:* | before 4.8.0.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:* | before 4.8.0.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:* | before 4.8.0.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:* | before 4.8.0.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:* | before 4.8.0.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_rte_\(for_beckhoff_cx\)_sl:*:*:*:*:*:*:*:* | before 3.5.19.0 | Vulnerable | CODESYS |
- cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:* Versions before 4.8.0.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:* Versions before 4.8.0.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:* Versions before 4.8.0.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:* Versions before 4.8.0.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:* Versions before 4.8.0.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:* Versions before 4.8.0.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:* Versions before 4.8.0.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:* Versions before 4.8.0.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:* Versions before 4.8.0.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_rte_\(for_beckhoff_cx\)_sl:*:*:*:*:*:*:*:* Versions before 3.5.19.0 Vulnerable ·CODESYS
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:codesys:control_rte_\(sl\):*:*:*:*:*:*:*:* | before 3.5.19.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_runtime_system_toolkit:*:*:*:*:*:*:*:* | before 3.5.19.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_win_\(sl\):*:*:*:*:*:*:*:* | before 3.5.19.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:development_system_v3:*:*:*:*:*:*:*:* | before 3.5.19.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:hmi_\(sl\):*:*:*:*:*:*:*:* | before 3.5.19.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:safety_sil2_psp:*:*:*:*:*:*:*:* | before 3.5.19.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:safety_sil2_runtime_toolkit:*:*:*:*:*:*:*:* | before 3.5.19.0 | Vulnerable | CODESYS |
- cpe:2.3:a:codesys:control_rte_\(sl\):*:*:*:*:*:*:*:* Versions before 3.5.19.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_runtime_system_toolkit:*:*:*:*:*:*:*:* Versions before 3.5.19.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_win_\(sl\):*:*:*:*:*:*:*:* Versions before 3.5.19.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:development_system_v3:*:*:*:*:*:*:*:* Versions before 3.5.19.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:hmi_\(sl\):*:*:*:*:*:*:*:* Versions before 3.5.19.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:safety_sil2_psp:*:*:*:*:*:*:*:* Versions before 3.5.19.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:safety_sil2_runtime_toolkit:*:*:*:*:*:*:*:* Versions before 3.5.19.0 Vulnerable ·CODESYS
Remediation
- Fix · CNA CODESYS Control RTE (SL) (CODESYS) Fixed in V3.5.19.0
- Fix · CNA CODESYS Control RTE (for Beckhoff CX) SL (CODESYS) Fixed in V3.5.19.0
- Fix · CNA CODESYS Control Win (SL) (CODESYS) Fixed in V3.5.19.0
- Fix · CNA CODESYS Control Runtime System Toolkit (CODESYS) Fixed in V3.5.19.0
- Fix · CNA CODESYS Safety SIL2 Runtime Toolkit (CODESYS) Fixed in V3.5.19.0
- Fix · CNA CODESYS Safety SIL2 PSP (CODESYS) Fixed in V3.5.19.0
- Fix · CNA CODESYS HMI (SL) (CODESYS) Fixed in V3.5.19.0
- Fix · CNA CODESYS Development System V3 (CODESYS) Fixed in V3.5.19.0
- Fix · CNA CODESYS Control for BeagleBone SL (CODESYS) Fixed in V4.8.0.0
- Fix · CNA CODESYS Control for emPC-A/iMX6 SL (CODESYS) Fixed in V4.8.0.0
- Fix · CNA CODESYS Control for IOT2000 SL (CODESYS) Fixed in V4.8.0.0
- Fix · CNA CODESYS Control for Linux SL (CODESYS) Fixed in V4.8.0.0
- Fix · CNA CODESYS Control for PFC100 SL (CODESYS) Fixed in V4.8.0.0
- Fix · CNA CODESYS Control for PFC200 SL (CODESYS) Fixed in V4.8.0.0
- Fix · CNA CODESYS Control for PLCnext SL (CODESYS) Fixed in V4.8.0.0
- Fix · CNA CODESYS Control for Raspberry Pi SL (CODESYS) Fixed in V4.8.0.0
- Fix · CNA CODESYS Control for WAGO Touch Panels 600 SL (CODESYS) Fixed in V4.8.0.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
CODESYS Control RTE (SL), CODESYS Control RTE (for Beckhoff CX) SL and 15 more products V3.5.19.0, V4.8.0.0
16 records Highest priority Priority MEDIUM 13 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2022-23467 CODESYS: Multiple products prone to out-of-bounds writePriority MEDIUM 44
- TI-2022-23479 CODESYS: Multiple products prone to Improper Input ValidationPriority MEDIUM 43
- TI-2022-23478 CODESYS: Multiple products prone to stack based out-of-bounds writePriority MEDIUM 43
Timeline
- 2026-10-02 Threatist record created from CVE-2022-47382
- 2026-10-03 Alias added: GHSA-xj2p-4gc4-hvf5
References
More CODESYS Control For Beaglebone Sl vulnerabilities
- TI-2019-06497 An issue was discovered in 3S-Smart CODESYS V3 products. CVSS 3.1CRITICAL 9.8
- TI-2018-07501 Improper access control in 3S-Smart Software Solutions GmbH CODESYS Control V3 products… CVSS 3.0CRITICAL 9.8
- TI-2022-23467 CODESYS: Multiple products prone to out-of-bounds write CVSS 3.1HIGH 8.8
- TI-2022-23479 CODESYS: Multiple products prone to Improper Input Validation CVSS 3.1HIGH 7.5
- TI-2022-23478 CODESYS: Multiple products prone to stack based out-of-bounds write CVSS 3.1HIGH 8.8
- TI-2022-23477 CODESYS: Multiple products prone to stack based out-of-bounds write CVSS 3.1HIGH 8.8
Sources
- CVE-2022-47382 · CVE Program
- CVE-2022-47382 · NVD
- FIRST EPSS
- GHSA-xj2p-4gc4-hvf5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences