{"id":"CVE-2022-22508","state":"PUBLISHED","title":"CODESYS V3: Improper Input Validation","description":"Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type.","publishedAt":"2023-05-15T09:27:38.793Z","updatedAt":"2025-01-23T19:24:35.687Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","source":"CERTVDE"},"assigner":"CERTVDE","products":["CODESYS V3 CODESYS Control RTE (SL)","CODESYS V3 CODESYS Control RTE (for Beckhoff CX) SL","CODESYS V3 CODESYS Control Win (SL)","CODESYS V3 CODESYS HMI (SL)","CODESYS V3 CODESYS Control Runtime System Toolkit","CODESYS V3 CODESYS Control for BeagleBone SL","CODESYS V3 CODESYS Control for emPC-A/iMX6 SL","CODESYS V3 CODESYS Control for IOT2000 SL","CODESYS V3 CODESYS Control for Linux SL","CODESYS V3 CODESYS Control for PFC100 SL","CODESYS V3 CODESYS Control for PFC200 SL","CODESYS V3 CODESYS Control for PLCnext SL","CODESYS V3 CODESYS Control for Raspberry Pi SL","CODESYS V3 CODESYS Control for WAGO Touch Panels 600 SL"],"affected":[{"vendor":"CODESYS V3","product":"CODESYS Control RTE (SL)","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V3.5.18.40","versionType":"custom"}],"modules":["CmpNameServiceServer"]},{"vendor":"CODESYS V3","product":"CODESYS Control RTE (for Beckhoff CX) SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V3.5.18.40","versionType":"custom"}],"modules":["CmpNameServiceServer"]},{"vendor":"CODESYS V3","product":"CODESYS Control Win (SL)","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V3.5.18.40","versionType":"custom"}],"modules":["CmpNameServiceServer"]},{"vendor":"CODESYS V3","product":"CODESYS HMI (SL)","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V3.5.18.40","versionType":"custom"}],"modules":["CmpNameServiceServer"]},{"vendor":"CODESYS V3","product":"CODESYS Control Runtime System Toolkit","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V3.5.18.40","versionType":"custom"}],"modules":["CmpNameServiceServer"]},{"vendor":"CODESYS V3","product":"CODESYS Control for BeagleBone SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for emPC-A/iMX6 SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for IOT2000 SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for Linux SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for PFC100 SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for PFC200 SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for PLCnext SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for Raspberry Pi SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for WAGO Touch Panels 600 SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]}],"references":["https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17351&token=a7c02b2825fea2bcaf80c1a8e62097d72ec90f1a&download="],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T19:49:38.433Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/22xxx/CVE-2022-22508.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-22508","state":"PUBLISHED","datePublished":"2023-05-15T09:27:38.793Z","dateUpdated":"2025-01-23T19:24:35.687Z","assignerShortName":"CERTVDE","assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateReserved":"2022-01-03T22:35:36.932Z"},"containers":{"cna":{"title":"CODESYS V3: Improper Input Validation","descriptions":[{"lang":"en","value":"Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type."}],"affected":[{"vendor":"CODESYS V3","product":"CODESYS Control RTE (SL)","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V3.5.18.40","versionType":"custom"}],"modules":["CmpNameServiceServer"]},{"vendor":"CODESYS V3","product":"CODESYS Control RTE (for Beckhoff CX) SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V3.5.18.40","versionType":"custom"}],"modules":["CmpNameServiceServer"]},{"vendor":"CODESYS V3","product":"CODESYS Control Win (SL)","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V3.5.18.40","versionType":"custom"}],"modules":["CmpNameServiceServer"]},{"vendor":"CODESYS V3","product":"CODESYS HMI (SL)","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V3.5.18.40","versionType":"custom"}],"modules":["CmpNameServiceServer"]},{"vendor":"CODESYS V3","product":"CODESYS Control Runtime System Toolkit","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V3.5.18.40","versionType":"custom"}],"modules":["CmpNameServiceServer"]},{"vendor":"CODESYS V3","product":"CODESYS Control for BeagleBone SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for emPC-A/iMX6 SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for IOT2000 SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for Linux SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for PFC100 SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for PFC200 SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for PLCnext SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for Raspberry Pi SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]},{"vendor":"CODESYS V3","product":"CODESYS Control for WAGO Touch Panels 600 SL","defaultStatus":"unaffected","versions":[{"version":"V0.0.0.0","status":"affected","lessThan":"V4.7.0.0","versionType":"custom"}]}],"references":[{"url":"https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17351&token=a7c02b2825fea2bcaf80c1a8e62097d72ec90f1a&download="}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERTVDE","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateUpdated":"2023-05-15T09:27:38.793Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"icsbob"}],"source":{"defect":["CERT@VDE#64333"],"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17351&token=a7c02b2825fea2bcaf80c1a8e62097d72ec90f1a&download=","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T03:14:55.254Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-23T19:24:19.962258Z","id":"CVE-2022-22508","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-23T19:24:35.687Z"}}]}}}