CVE-2022-31806

moderate-risk

Published 2022-06-24

In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller.

Do I need to act?

0.54% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (2)

Plcwinnt

Runtime Toolkit

Affected Vendors

Codesys

References (2)

Third Party Advisory https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17140&token=6aa2c5c4a...

/ 100

moderate-risk

Severity 32/34 · Critical

Exploitability 2/34 · Minimal

Exposure 7/34 · Low