{"id":"CVE-2022-4224","state":"PUBLISHED","title":"CODESYS:  Exposure of Resource to Wrong Sphere in CODESYS V3","description":"In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device.","publishedAt":"2023-03-23T11:15:37.014Z","updatedAt":"2026-05-29T14:08:13.754Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"CERTVDE"},"assigner":"CERTVDE","products":["CODESYS Control RTE (SL) ","CODESYS Control RTE (for Beckhoff CX) SL","CODESYS Control Win (SL)","CODESYS  Runtime Toolkit ","CODESYS Safety SIL2 Runtime Toolkit","CODESYS Safety SIL2 PSP","CODESYS HMI (SL) ","CODESYS Development System V3","CODESYS  Control for BeagleBone SL ","CODESYS Control for emPC-A/iMX6 SL","CODESYS Control for IOT2000 SL","CODESYS Control for Linux SL","CODESYS  Control for PFC100 SL","CODESYS  Control for PFC200 SL","CODESYS Control for PLCnext SL","CODESYS Control for Raspberry Pi SL","CODESYS Control for WAGO Touch Panels 600 SL"],"affected":[{"vendor":"CODESYS","product":"Control RTE (SL) ","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control RTE (for Beckhoff CX) SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control Win (SL)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":" Runtime Toolkit ","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Safety SIL2 Runtime Toolkit","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Safety SIL2 PSP","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"HMI (SL) ","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Development System V3","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":" Control for BeagleBone SL ","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for emPC-A/iMX6 SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for IOT2000 SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for Linux SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":" Control for PFC100 SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":" Control for PFC200 SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for PLCnext SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for Raspberry Pi SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for WAGO Touch Panels 600 SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]}],"references":["https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17553&token=cf49757d232ea8021f0c0dd6c65e71ea5942b12d&download="],"weaknesses":["CWE-1188"],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/4xxx/CVE-2022-4224.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-4224","state":"PUBLISHED","datePublished":"2023-03-23T11:15:37.014Z","dateUpdated":"2026-05-29T14:08:13.754Z","assignerShortName":"CERTVDE","assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateReserved":"2022-11-30T06:54:13.183Z"},"containers":{"cna":{"title":"CODESYS:  Exposure of Resource to Wrong Sphere in CODESYS V3","descriptions":[{"lang":"en","value":"In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device."}],"affected":[{"vendor":"CODESYS","product":"Control RTE (SL) ","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control RTE (for Beckhoff CX) SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control Win (SL)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":" Runtime Toolkit ","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Safety SIL2 Runtime Toolkit","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Safety SIL2 PSP","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"HMI (SL) ","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Development System V3","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"3.5.19.0","versionType":"custom"}]},{"vendor":"CODESYS","product":" Control for BeagleBone SL ","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for emPC-A/iMX6 SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for IOT2000 SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for Linux SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":" Control for PFC100 SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":" Control for PFC200 SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for PLCnext SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for Raspberry Pi SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]},{"vendor":"CODESYS","product":"Control for WAGO Touch Panels 600 SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","status":"affected","lessThan":"4.8.0.0","versionType":"custom"}]}],"references":[{"url":"https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17553&token=cf49757d232ea8021f0c0dd6c65e71ea5942b12d&download="}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1188","description":"CWE-1188 Insecure Default Initialization of Resource","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERTVDE","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateUpdated":"2023-08-09T10:47:13.144Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Franklin Zhao from ELEX FEIGONG RESEARCH INSTITUTE of Elex CyberSecurity"},{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Reid Wightman of Dragos"}],"source":{"defect":["CERT@VDE#64318"],"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17553&token=cf49757d232ea8021f0c0dd6c65e71ea5942b12d&download=","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T01:34:49.591Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-29T14:07:26.160566Z","id":"CVE-2022-4224","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-29T14:08:13.754Z"}}]}}}