CVE-2022-31802

—

CVSS 3.1

9.8 critical

EPSS

1%p68

Published

Jun 24, 2022 (Jun 24, 2022)

Modified

Jun 17, 2026

Description

In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gateway password.

Vendors: codesys
Products: gateway
Weakness: CWE-187
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news2 stories

Two critical flaws affect CODESYS ICS Automation Software

Security AffairsJun 28, 06:38 UTC · Jun 28, 2022Vulnerability CVE-2022-31805 CVE-2022-31806 CVE-2022-31802+2 CVEs

Critical Security Flaws Identified in CODESYS ICS Automation Software

The Hacker NewsJun 27, 10:35 UTC · Jun 27, 2022Vulnerability CVE-2022-31805 CVE-2022-31806 CVE-2022-32136+4 CVEs