« Volver al listado

CVE-2022-32137

Estado: ModificadaAlta (8.8)—

In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-service condition or memory overwrite. User interaction is not required.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Codesys — PlcwinntCodesys — Runtime Toolkit

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-32137",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "CODESYS",
          "product": "Runtime Toolkit",
          "versions": [
            {
              "status": "affected",
              "version": "V2",
              "lessThan": "V2.4.7.57",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "32 bit"
          ]
        },
        {
          "vendor": "CODESYS",
          "product": "PLCWinNT",
          "versions": [
            {
              "status": "affected",
              "version": "V2",
              "lessThan": "V2.4.7.57",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-06-24T08:15:07.773",
  "references": [
    {
      "url": "https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "info@cert.vde.com"
    },
    {
      "url": "https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-service condition or memory overwrite. User interaction is not required."
    },
    {
      "lang": "es",
      "value": "En diversos productos de CODESYS, un atacante remoto poco privilegiado puede diseñar una petición que puede causar un desbordamiento de búfer en la región heap de la memoria, resultando en una condición de negación de servicio o sobreescritura de memoria. No es requerida una interacción del usuario"
    }
  ],
  "lastModified": "2026-06-17T04:46:44.667",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:codesys:plcwinnt:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B26FF87-3FCD-496E-97C5-A1E4F6AACCB1",
              "versionEndExcluding": "2.4.7.57",
              "versionStartIncluding": "2.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:x86:*",
              "vulnerable": true,
              "matchCriteriaId": "CF74E74E-4EF8-4C84-A9A1-612AB7FC88BA",
              "versionEndExcluding": "2.4.7.57",
              "versionStartIncluding": "2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "info@cert.vde.com"
}