Vulnerability-Lookup

VAR-202206-1953

Vulnerability from variot - Updated: 2024-09-17 23:19

In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202206-1953",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "edge gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "codesys",
        "version": "3.5.18.30"
      },
      {
        "model": "development system",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "codesys",
        "version": "2.3.9.69"
      },
      {
        "model": "gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "codesys",
        "version": "2.3.9.38"
      },
      {
        "model": "plchandler",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "codesys",
        "version": "3.5.18.30"
      },
      {
        "model": "opc server",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "codesys",
        "version": "3.5.18.30"
      },
      {
        "model": "plcwinnt",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "codesys",
        "version": "2.4.7.57"
      },
      {
        "model": "web server",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "codesys",
        "version": "1.1.9.23"
      },
      {
        "model": "hmi sl",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "codesys",
        "version": "3.5.18.30"
      },
      {
        "model": "sp realtime nt",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "codesys",
        "version": "2.3.7.30"
      },
      {
        "model": "runtime toolkit",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "codesys",
        "version": "2.4.7.57"
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-31805"
      }
    ]
  },
  "cve": "CVE-2022-31805",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2022-31805",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.1,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-423674",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2022-31805",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2022-31805",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "info@cert.vde.com",
            "id": "CVE-2022-31805",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202206-2454",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-423674",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2022-31805",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-423674"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31805"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-2454"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31805"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31805"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-31805"
      },
      {
        "db": "VULHUB",
        "id": "VHN-423674"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31805"
      }
    ],
    "trust": 1.08
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2022-31805",
        "trust": 1.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-2454",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-423674",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31805",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-423674"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31805"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-2454"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31805"
      }
    ]
  },
  "id": "VAR-202206-1953",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-423674"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-09-17T23:19:11.279000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CODESYS Development System Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=199005"
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/ic3sw0rd/Codesys_V2_Vulnerability "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2022-31805"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-2454"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-523",
        "trust": 1.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-423674"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31805"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://customers.codesys.com/index.php?eid=dumpfile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download="
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2022-31805/"
      },
      {
        "trust": 0.1,
        "url": "https://customers.codesys.com/index.php?eid=dumpfile\u0026amp;t=f\u0026amp;f=17140\u0026amp;token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026amp;download="
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/523.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/ic3sw0rd/codesys_v2_vulnerability"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-423674"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31805"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-2454"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31805"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-423674"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31805"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-2454"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31805"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-06-24T00:00:00",
        "db": "VULHUB",
        "id": "VHN-423674"
      },
      {
        "date": "2022-06-24T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-31805"
      },
      {
        "date": "2022-06-24T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202206-2454"
      },
      {
        "date": "2022-06-24T08:15:07.590000",
        "db": "NVD",
        "id": "CVE-2022-31805"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-09-23T00:00:00",
        "db": "VULHUB",
        "id": "VHN-423674"
      },
      {
        "date": "2022-07-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-31805"
      },
      {
        "date": "2022-07-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202206-2454"
      },
      {
        "date": "2024-09-16T19:16:03.700000",
        "db": "NVD",
        "id": "CVE-2022-31805"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-2454"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "CODESYS Development System Security hole",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-2454"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-2454"
      }
    ],
    "trust": 0.6
  }
}

CVE-2022-31805 (GCVE-0-2022-31805)

Vulnerability from cvelistv5 – Published: 2022-06-24 07:46 – Updated: 2024-09-16 18:55

Title

Insecure transmission of credentials

Summary

In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-523 - Unprotected Transport of Credentials

Assigner

CERTVDE icscert root

References

1 reference

URL	Tags
https://customers.codesys.com/index.php?eID=dumpF…	x_refsource_CONFIRM

Impacted products

12 products

Vendor	Product	Version
CODESYS	CODESYS Development System	Affected: V2 , < V2.3.9.69 (custom) Affected: V3 , < V3.5.18.30 (custom)
CODESYS	CODESYS Gateway Client	Affected: V2 , < V2.3.9.38 (custom)
CODESYS	CODESYS Gateway Server	Affected: V2 , < V2.3.9.38 (custom)
CODESYS	CODESYS Web server	Affected: V1 , < V1.1.9.23 (custom)
CODESYS	CODESYS SP Realtime NT	Affected: V2 , < V2.3.7.30 (custom)
CODESYS	CODESYS PLCWinNT	Affected: V2 , < V2.4.7.57 (custom)
CODESYS	CODESYS Runtime Toolkit 32 bit full	Affected: V2 , < V2.4.7.57 (custom)
CODESYS	CODESYS Edge Gateway for Windows	Affected: V3 , < V3.5.18.30 (custom)
CODESYS	CODESYS HMI (SL)	Affected: V3 , < V3.5.18.30 (custom)
CODESYS	CODESYS OPC DA Server SL	Affected: V3 , < V3.5.18.30 (custom)
CODESYS	CODESYS PLCHandler	Affected: V3 , < V3.5.18.30 (custom)
CODESYS	CODESYS Gateway	Affected: V3 , < V3.5.18.30 (custom)

Date Public

2022-06-22 22:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:01.086Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download="
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Development System",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.3.9.69",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            },
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Gateway Client",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.3.9.38",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Gateway Server",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.3.9.38",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Web server",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V1.1.9.23",
              "status": "affected",
              "version": "V1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS SP Realtime NT",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.3.7.30",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS PLCWinNT",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.4.7.57",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Runtime Toolkit 32 bit full",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V2.4.7.57",
              "status": "affected",
              "version": "V2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Edge Gateway for Windows",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS HMI (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS OPC DA Server SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS PLCHandler",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Gateway",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "V3.5.18.30",
              "status": "affected",
              "version": "V3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2022-06-22T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.\u003c/p\u003e"
            }
          ],
          "value": "In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-523",
              "description": "CWE-523 Unprotected Transport of Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-09T12:54:39.506Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download="
        }
      ],
      "source": {
        "defect": [
          "CERT@VDE#",
          "64140"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Insecure transmission of credentials",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "info@cert.vde.com",
          "DATE_PUBLIC": "2022-06-23T10:00:00.000Z",
          "ID": "CVE-2022-31805",
          "STATE": "PUBLIC",
          "TITLE": "Insecure transmission of credentials"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CODESYS Development System",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.3.9.69"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Gateway Client",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.3.9.38"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Gateway Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.3.9.38"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Web server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V1",
                            "version_value": "V1.1.9.23"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS SP Realtime NT",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.3.7.30"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS PLCWinNT",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.4.7.57"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Runtime Toolkit 32 bit full",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V2",
                            "version_value": "V2.4.7.57"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Edge Gateway for Windows",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS HMI (SL)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS OPC DA Server SL",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS PLCHandler",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CODESYS Gateway",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "V3",
                            "version_value": "V3.5.18.20"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "CODESYS"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-523 Unprotected Transport of Credentials"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download=",
              "refsource": "CONFIRM",
              "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17140\u0026token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c\u0026download="
            }
          ]
        },
        "source": {
          "defect": [
            "CERT@VDE#",
            "64140"
          ],
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2022-31805",
    "datePublished": "2022-06-24T07:46:15.076Z",
    "dateReserved": "2022-05-30T00:00:00.000Z",
    "dateUpdated": "2024-09-16T18:55:26.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.