CVE-2022-31806

—

CVSS 3.1

9.8 critical

EPSS

1%p65

Published

Jun 24, 2022 (Jun 24, 2022)

Modified

Jun 17, 2026

Description

In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller.

Vendors: codesys
Products: plcwinnt, runtime toolkit
Weakness: CWE-1188
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news4 stories

Vulnerabilities found affecting OT products from German companies Festo and CODESYS

The RecordJan 9, 00:00 UTC · Jan 9, 2023Vulnerability CVE-2022-3079 CVE-2022-3270 CVE-2022-4048+2 CVEs

3 New Vulnerabilities Affect OT Products from German Companies Festo and CODESYS

The Hacker NewsNov 30, 09:41 UTC · Nov 30, 2022Vulnerability CVE-2022-3270 CVE-2022-3079 CVE-2022-4048+2 CVEs

Two critical flaws affect CODESYS ICS Automation Software

Security AffairsJun 28, 06:38 UTC · Jun 28, 2022Vulnerability CVE-2022-31805 CVE-2022-31806 CVE-2022-31802+2 CVEs

Critical Security Flaws Identified in CODESYS ICS Automation Software

The Hacker NewsJun 27, 10:35 UTC · Jun 27, 2022Vulnerability CVE-2022-31805 CVE-2022-31806 CVE-2022-32136+4 CVEs