{"id":"CVE-2022-31805","state":"PUBLISHED","title":"Insecure transmission of credentials","description":"In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.","publishedAt":"2022-06-24T07:46:15.076Z","updatedAt":"2024-09-16T18:55:26.939Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"CERTVDE"},"assigner":"CERTVDE","products":["CODESYS CODESYS Development System","CODESYS CODESYS Gateway Client","CODESYS CODESYS Gateway Server","CODESYS CODESYS Web server","CODESYS CODESYS SP Realtime NT","CODESYS CODESYS PLCWinNT","CODESYS CODESYS Runtime Toolkit 32 bit full","CODESYS CODESYS Edge Gateway for Windows","CODESYS CODESYS HMI (SL)","CODESYS CODESYS OPC DA Server SL","CODESYS CODESYS PLCHandler","CODESYS CODESYS Gateway"],"affected":[{"vendor":"CODESYS","product":"CODESYS Development System","defaultStatus":"unaffected","versions":[{"version":"V2","status":"affected","lessThan":"V2.3.9.69","versionType":"custom"},{"version":"V3","status":"affected","lessThan":"V3.5.18.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS Gateway Client","defaultStatus":"unaffected","versions":[{"version":"V2","status":"affected","lessThan":"V2.3.9.38","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS Gateway Server","defaultStatus":"unaffected","versions":[{"version":"V2","status":"affected","lessThan":"V2.3.9.38","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS Web server","defaultStatus":"unaffected","versions":[{"version":"V1","status":"affected","lessThan":"V1.1.9.23","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS SP Realtime NT","defaultStatus":"unaffected","versions":[{"version":"V2","status":"affected","lessThan":"V2.3.7.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS PLCWinNT","defaultStatus":"unaffected","versions":[{"version":"V2","status":"affected","lessThan":"V2.4.7.57","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS Runtime Toolkit 32 bit full","defaultStatus":"unaffected","versions":[{"version":"V2","status":"affected","lessThan":"V2.4.7.57","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS Edge Gateway for Windows","defaultStatus":"unaffected","versions":[{"version":"V3","status":"affected","lessThan":"V3.5.18.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS HMI (SL)","defaultStatus":"unaffected","versions":[{"version":"V3","status":"affected","lessThan":"V3.5.18.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS OPC DA Server SL","defaultStatus":"unaffected","versions":[{"version":"V3","status":"affected","lessThan":"V3.5.18.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS PLCHandler","defaultStatus":"unaffected","versions":[{"version":"V3","status":"affected","lessThan":"V3.5.18.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS Gateway","defaultStatus":"unaffected","versions":[{"version":"V3","status":"affected","lessThan":"V3.5.18.30","versionType":"custom"}]}],"references":["https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17140&token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c&download="],"weaknesses":["CWE-523"],"ingestedAt":"2026-10-29T19:50:06.617Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/31xxx/CVE-2022-31805.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-31805","state":"PUBLISHED","datePublished":"2022-06-24T07:46:15.076Z","dateUpdated":"2024-09-16T18:55:26.939Z","assignerShortName":"CERTVDE","assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateReserved":"2022-05-30T00:00:00.000Z"},"containers":{"cna":{"title":"Insecure transmission of credentials","descriptions":[{"lang":"en","value":"In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected."}],"affected":[{"vendor":"CODESYS","product":"CODESYS Development System","defaultStatus":"unaffected","versions":[{"version":"V2","status":"affected","lessThan":"V2.3.9.69","versionType":"custom"},{"version":"V3","status":"affected","lessThan":"V3.5.18.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS Gateway Client","defaultStatus":"unaffected","versions":[{"version":"V2","status":"affected","lessThan":"V2.3.9.38","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS Gateway Server","defaultStatus":"unaffected","versions":[{"version":"V2","status":"affected","lessThan":"V2.3.9.38","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS Web server","defaultStatus":"unaffected","versions":[{"version":"V1","status":"affected","lessThan":"V1.1.9.23","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS SP Realtime NT","defaultStatus":"unaffected","versions":[{"version":"V2","status":"affected","lessThan":"V2.3.7.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS PLCWinNT","defaultStatus":"unaffected","versions":[{"version":"V2","status":"affected","lessThan":"V2.4.7.57","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS Runtime Toolkit 32 bit full","defaultStatus":"unaffected","versions":[{"version":"V2","status":"affected","lessThan":"V2.4.7.57","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS Edge Gateway for Windows","defaultStatus":"unaffected","versions":[{"version":"V3","status":"affected","lessThan":"V3.5.18.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS HMI (SL)","defaultStatus":"unaffected","versions":[{"version":"V3","status":"affected","lessThan":"V3.5.18.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS OPC DA Server SL","defaultStatus":"unaffected","versions":[{"version":"V3","status":"affected","lessThan":"V3.5.18.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS PLCHandler","defaultStatus":"unaffected","versions":[{"version":"V3","status":"affected","lessThan":"V3.5.18.30","versionType":"custom"}]},{"vendor":"CODESYS","product":"CODESYS Gateway","defaultStatus":"unaffected","versions":[{"version":"V3","status":"affected","lessThan":"V3.5.18.30","versionType":"custom"}]}],"references":[{"url":"https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17140&token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c&download=","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-523","description":"CWE-523 Unprotected Transport of Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERTVDE","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateUpdated":"2023-05-09T12:54:39.506Z"},"datePublic":"2022-06-22T22:00:00.000Z","source":{"defect":["CERT@VDE#","64140"],"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"info@cert.vde.com","DATE_PUBLIC":"2022-06-23T10:00:00.000Z","ID":"CVE-2022-31805","STATE":"PUBLIC","TITLE":"Insecure transmission of credentials"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"CODESYS Development System","version":{"version_data":[{"version_affected":"<","version_name":"V2","version_value":"V2.3.9.69"},{"version_affected":"<","version_name":"V3","version_value":"V3.5.18.20"}]}},{"product_name":"CODESYS Gateway Client","version":{"version_data":[{"version_affected":"<","version_name":"V2","version_value":"V2.3.9.38"}]}},{"product_name":"CODESYS Gateway Server","version":{"version_data":[{"version_affected":"<","version_name":"V2","version_value":"V2.3.9.38"}]}},{"product_name":"CODESYS Web server","version":{"version_data":[{"version_affected":"<","version_name":"V1","version_value":"V1.1.9.23"}]}},{"product_name":"CODESYS SP Realtime NT","version":{"version_data":[{"version_affected":"<","version_name":"V2","version_value":"V2.3.7.30"}]}},{"product_name":"CODESYS PLCWinNT","version":{"version_data":[{"version_affected":"<","version_name":"V2","version_value":"V2.4.7.57"}]}},{"product_name":"CODESYS Runtime Toolkit 32 bit full","version":{"version_data":[{"version_affected":"<","version_name":"V2","version_value":"V2.4.7.57"}]}},{"product_name":"CODESYS Edge Gateway for Windows","version":{"version_data":[{"version_affected":"<","version_name":"V3","version_value":"V3.5.18.20"}]}},{"product_name":"CODESYS HMI (SL)","version":{"version_data":[{"version_affected":"<","version_name":"V3","version_value":"V3.5.18.20"}]}},{"product_name":"CODESYS OPC DA Server SL","version":{"version_data":[{"version_affected":"<","version_name":"V3","version_value":"V3.5.18.20"}]}},{"product_name":"CODESYS PLCHandler","version":{"version_data":[{"version_affected":"<","version_name":"V3","version_value":"V3.5.18.20"}]}},{"product_name":"CODESYS Gateway","version":{"version_data":[{"version_affected":"<","version_name":"V3","version_value":"V3.5.18.20"}]}}]},"vendor_name":"CODESYS"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-523 Unprotected Transport of Credentials"}]}]},"references":{"reference_data":[{"name":"https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17140&token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c&download=","refsource":"CONFIRM","url":"https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17140&token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c&download="}]},"source":{"defect":["CERT@VDE#","64140"],"discovery":"UNKNOWN"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17140&token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c&download=","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T07:26:01.086Z"}}]}}}