Insecure transmission of credentials (CODESYS CODESYS Development System)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.05 % · percentile 64 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- CERTVDE
- NVD status
- Modified
Description
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.
Weaknesses (CWE)
- CWE-523 — Unprotected Transport of Credentials
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CERTVDE |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · info@cert.vde.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Secondary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2022-53194
- GCVE · GCVE-0-2022-31805
Affected configurations (NVD CPE)
cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*< 2.3.9.69cpe:2.3:a:codesys:edge_gateway:*:*:*:*:*:windows:*:*< 3.5.18.30cpe:2.3:a:codesys:gateway:*:*:*:*:*:*:*:*< 2.3.9.38cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:*< 3.5.18.30cpe:2.3:a:codesys:opc_server:*:*:*:*:*:*:*:*< 3.5.18.30cpe:2.3:a:codesys:plchandler:*:*:*:*:*:*:*:*< 3.5.18.30cpe:2.3:a:codesys:plcwinnt:*:*:*:*:*:*:*:*< 2.4.7.57cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:x86:*< 2.4.7.57cpe:2.3:a:codesys:sp_realtime_nt:*:*:*:*:*:*:*:*< 2.3.7.30cpe:2.3:a:codesys:web_server:*:*:*:*:*:*:*:*< 1.1.9.23
Affected products
| Product | Versions |
|---|---|
| CODESYS · CODESYS Development System | affected V2 < V2.3.9.69 ; affected V3 < V3.5.18.30 |
| CODESYS · CODESYS Gateway Client | affected V2 < V2.3.9.38 |
| CODESYS · CODESYS Gateway Server | affected V2 < V2.3.9.38 |
| CODESYS · CODESYS Web server | affected V1 < V1.1.9.23 |
| CODESYS · CODESYS SP Realtime NT | affected V2 < V2.3.7.30 |
| CODESYS · CODESYS PLCWinNT | affected V2 < V2.4.7.57 |
| CODESYS · CODESYS Runtime Toolkit 32 bit full | affected V2 < V2.4.7.57 |
| CODESYS · CODESYS Edge Gateway for Windows | affected V3 < V3.5.18.30 |
| CODESYS · CODESYS HMI (SL) | affected V3 < V3.5.18.30 |
| CODESYS · CODESYS OPC DA Server SL | affected V3 < V3.5.18.30 |
| CODESYS · CODESYS PLCHandler | affected V3 < V3.5.18.30 |
| CODESYS · CODESYS Gateway | affected V3 < V3.5.18.30 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |