{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "UPDATE A: Solution has updated release datesUPDATE B: Solution has updated release datesThis Advisory is published with reference to:\n\nCODESYS Advisory 2022-11 (Security update for CODESYS Control V2)\nCODESYS Advisory 2022-12 (Security update for CODESYS V2 password transport)\nCODESYS Advisory 2022-13 (Security update for CODESYS Gateway V2)",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "From vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\nBy crafting special packets / requests a low skilled attacker can exploit the vulnerabilities. This can lead to denial-of-service conditions or deleting files.\n\nFrom vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\nA low skilled attacker is able to gather insufficiently protected credentials having access to the communication between client and server.\n\nFrom vulnerabilities CVE-2022-31802, CVE-2022-31803, CVE-2022-31804 (CODESYS Advisory 2022-13):\nAn attacker with low skills is able to gather insufficiently protected credentials having local access or access to the online communication traffic",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8203/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8204/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8206/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8207/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8208/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8210/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8211/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8212/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8213/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8214/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8216/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8217/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 4th Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-823               | UPDATE B: Available in Q1 2024   |\n| 750-332               | UPDATE B: Available in Q1 2024   |\n| 750-832/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-862               | UPDATE B: Available in Q1 2024   |\n| 750-890/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-891               | UPDATE B: Available in Q1 2024   |\n| 750-893               | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 3rd Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-331               | UPDATE B: Available in Q1 2024   |\n| 750-829               | UPDATE B: Available in Q1 2024   |\n| 750-831/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-852               | UPDATE B: Available in Q1 2024   |\n| 750-880/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-881               | UPDATE B: Available in Q1 2024   |\n| 750-882               | UPDATE B: Available in Q1 2024   |\n| 750-885/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-889               | UPDATE B: Available in Q1 2024   |\n\n### Engineering Software\n\n| Name             | Firmware                         |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32  | UPDATE B: Available in Q1 2024   |",
        "title": "Remediation"
      },
      {
        "category": "general",
        "text": "- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n\n- Use firewalls to protect and separate the control system network from other networks\n\n- Use VPN (Virtual Private Networks) tunnels if remote access is required\n\n- Activate and apply user management and password features\n\n- Use encrypted communication links\n\n- Limit the access to both development and control system by physical means, operating system features, etc.\n\n- Protect both development and control system by using up to date virus detecting solutions\n\nFor further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at\nwww.codesys.com/security/security-reports.html",
        "title": "General Mitigation Recommendations"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@wago.com",
      "name": "WAGO GmbH \u0026 Co. KG",
      "namespace": "https://www.wago.com/psirt"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2022-040: WAGO: Multiple Vulnerabilities in Controller with WAGO I/O-Pro / CODESYS 2.3 Runtime - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2022-040/"
      },
      {
        "category": "self",
        "summary": "VDE-2022-040: WAGO: Multiple Vulnerabilities in Controller with WAGO I/O-Pro / CODESYS 2.3 Runtime - CSAF",
        "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-040.json"
      },
      {
        "category": "external",
        "summary": "WAGO PSIRT",
        "url": "https://www.wago.com/psirt"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for WAGO GmbH \u0026 Co. KG",
        "url": "https://certvde.com/en/advisories/vendor/wago/"
      }
    ],
    "title": "WAGO: Multiple Vulnerabilities in Controller with WAGO I/O-Pro / CODESYS 2.3 Runtime",
    "tracking": {
      "aliases": [
        "VDE-2022-040"
      ],
      "current_release_date": "2023-09-22T12:39:00.000Z",
      "generator": {
        "date": "2025-06-16T07:38:21.972Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.27"
        }
      },
      "id": "VDE-2022-040",
      "initial_release_date": "2022-10-17T08:00:00.000Z",
      "revision_history": [
        {
          "date": "2022-10-17T08:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial revision."
        },
        {
          "date": "2023-09-22T12:39:00.000Z",
          "number": "1.1.0",
          "summary": "Solution has updated"
        }
      ],
      "status": "final",
      "version": "1.1.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "750-331",
                "product": {
                  "name": "750-331",
                  "product_id": "CSAFPID-11001"
                }
              },
              {
                "category": "product_name",
                "name": "750-829",
                "product": {
                  "name": "750-829",
                  "product_id": "CSAFPID-11002"
                }
              },
              {
                "category": "product_name",
                "name": "750-831/xxx-xxx",
                "product": {
                  "name": "750-831/xxx-xxx",
                  "product_id": "CSAFPID-11003"
                }
              },
              {
                "category": "product_name",
                "name": "750-852",
                "product": {
                  "name": "750-852",
                  "product_id": "CSAFPID-11004"
                }
              },
              {
                "category": "product_name",
                "name": "750-881",
                "product": {
                  "name": "750-881",
                  "product_id": "CSAFPID-11005"
                }
              },
              {
                "category": "product_name",
                "name": "750-882",
                "product": {
                  "name": "750-882",
                  "product_id": "CSAFPID-11006"
                }
              },
              {
                "category": "product_name",
                "name": "750-885/xxx-xxx",
                "product": {
                  "name": "750-885/xxx-xxx",
                  "product_id": "CSAFPID-11007"
                }
              },
              {
                "category": "product_name",
                "name": "750-889",
                "product": {
                  "name": "750-889",
                  "product_id": "CSAFPID-11008"
                }
              },
              {
                "category": "product_name",
                "name": "750-880/xxx-xxx",
                "product": {
                  "name": "750-880/xxx-xxx",
                  "product_id": "CSAFPID-11009"
                }
              },
              {
                "category": "product_name",
                "name": "750-823",
                "product": {
                  "name": "750-823",
                  "product_id": "CSAFPID-11010"
                }
              },
              {
                "category": "product_name",
                "name": "750-332",
                "product": {
                  "name": "750-332",
                  "product_id": "CSAFPID-11011"
                }
              },
              {
                "category": "product_name",
                "name": "750-832/xxx-xxx",
                "product": {
                  "name": "750-832/xxx-xxx",
                  "product_id": "CSAFPID-11012"
                }
              },
              {
                "category": "product_name",
                "name": "750-862",
                "product": {
                  "name": "750-862",
                  "product_id": "CSAFPID-11013"
                }
              },
              {
                "category": "product_name",
                "name": "750-890/xxx-xxx",
                "product": {
                  "name": "750-890/xxx-xxx",
                  "product_id": "CSAFPID-11014"
                }
              },
              {
                "category": "product_name",
                "name": "750-891",
                "product": {
                  "name": "750-891",
                  "product_id": "CSAFPID-11015"
                }
              },
              {
                "category": "product_name",
                "name": "750-893",
                "product": {
                  "name": "750-893",
                  "product_id": "CSAFPID-11016"
                }
              },
              {
                "category": "product_name",
                "name": "PFC200",
                "product": {
                  "name": "PFC200",
                  "product_id": "CSAFPID-11017",
                  "product_identification_helper": {
                    "model_numbers": [
                      "750-8206/xxx-xxx",
                      "750-8204/xxx-xxx",
                      "750-8203/xxx-xxx",
                      "750-8214/xxx-xxx",
                      "750-8213/xxx-xxx",
                      "750-8212/xxx-xxx",
                      "750-8211/xxx-xxx",
                      "750-8216/xxx-xxx",
                      "750-8217/xxx-xxx",
                      "750-8210/xxx-xxx",
                      "750-8208/xxx-xxx",
                      "750-8202/xxx-xxx",
                      "750-8207/xxx-xxx"
                    ]
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=01.08.25(16)",
                "product": {
                  "name": "Firmware \u003c=01.08.25(16)",
                  "product_id": "CSAFPID-21002"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=01.03.25(16)",
                "product": {
                  "name": "Firmware \u003c=01.03.25(16)",
                  "product_id": "CSAFPID-21003"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=01.07.25(16)",
                "product": {
                  "name": "Firmware \u003c=01.07.25(16)",
                  "product_id": "CSAFPID-21004"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=01.09.25(16)",
                "product": {
                  "name": "Firmware \u003c=01.09.25(16)",
                  "product_id": "CSAFPID-21005"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=01.04.16(14)",
                "product": {
                  "name": "Firmware \u003c=01.04.16(14)",
                  "product_id": "CSAFPID-21006"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=01.02.16(06)",
                "product": {
                  "name": "Firmware \u003c=01.02.16(06)",
                  "product_id": "CSAFPID-21007"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=01.05.04(10)",
                "product": {
                  "name": "Firmware \u003c=01.05.04(10)",
                  "product_id": "CSAFPID-21008"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=03.10.08(22)",
                "product": {
                  "name": "Firmware \u003c=03.10.08(22)",
                  "product_id": "CSAFPID-21009"
                }
              },
              {
                "category": "product_version",
                "name": "FW17",
                "product": {
                  "name": "Firmware FW17",
                  "product_id": "CSAFPID-22001"
                }
              },
              {
                "category": "product_version",
                "name": "FW11 with BACnet Certification",
                "product": {
                  "name": "Firmware FW11 with BACnet Certification",
                  "product_id": "CSAFPID-22002"
                }
              },
              {
                "category": "product_version",
                "name": "FW11",
                "product": {
                  "name": "Firmware FW11",
                  "product_id": "CSAFPID-22003"
                }
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          },
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=2.3.9.68",
                    "product": {
                      "name": "Engineering Software \u003c=2.3.9.68",
                      "product_id": "CSAFPID-51001",
                      "product_identification_helper": {
                        "model_numbers": [
                          "WAGO-I/O-PRO"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.3.9.70",
                    "product": {
                      "name": "Engineering Software 2.3.9.70",
                      "product_id": "CSAFPID-52001"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Engineering Software"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "Wago"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ],
        "summary": "Affected products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "summary": "Fixed products."
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.04.16(14) installed on 750-331",
          "product_id": "CSAFPID-31001"
        },
        "product_reference": "CSAFPID-21006",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.04.16(14) installed on 750-829",
          "product_id": "CSAFPID-31002"
        },
        "product_reference": "CSAFPID-21006",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.04.16(14) installed on 750-831/xxx-xxx",
          "product_id": "CSAFPID-31003"
        },
        "product_reference": "CSAFPID-21006",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.09.25(16) installed on 750-852",
          "product_id": "CSAFPID-31004"
        },
        "product_reference": "CSAFPID-21005",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.09.25(16) installed on 750-881",
          "product_id": "CSAFPID-31005"
        },
        "product_reference": "CSAFPID-21005",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.08.25(16) installed on 750-882",
          "product_id": "CSAFPID-31006"
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.07.25(16) installed on 750-885/xxx-xxx",
          "product_id": "CSAFPID-31007"
        },
        "product_reference": "CSAFPID-21004",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.03.25(16) installed on 750-889",
          "product_id": "CSAFPID-31008"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.08.25(16) installed on 750-880/xxx-xxx",
          "product_id": "CSAFPID-31009"
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.05.04(10) installed on 750-823",
          "product_id": "CSAFPID-31010"
        },
        "product_reference": "CSAFPID-21008",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.02.16(06) installed on 750-332",
          "product_id": "CSAFPID-31011"
        },
        "product_reference": "CSAFPID-21007",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.02.16(06) installed on 750-832/xxx-xxx",
          "product_id": "CSAFPID-31012"
        },
        "product_reference": "CSAFPID-21007",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.05.04(10) installed on 750-862",
          "product_id": "CSAFPID-31013"
        },
        "product_reference": "CSAFPID-21008",
        "relates_to_product_reference": "CSAFPID-11013"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.05.04(10) installed on 750-890/xxx-xxx",
          "product_id": "CSAFPID-31014"
        },
        "product_reference": "CSAFPID-21008",
        "relates_to_product_reference": "CSAFPID-11014"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.05.04(10) installed on 750-891",
          "product_id": "CSAFPID-31015"
        },
        "product_reference": "CSAFPID-21008",
        "relates_to_product_reference": "CSAFPID-11015"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=01.05.04(10) installed on 750-893",
          "product_id": "CSAFPID-31016"
        },
        "product_reference": "CSAFPID-21008",
        "relates_to_product_reference": "CSAFPID-11016"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=03.10.08(22) installed on PFC200",
          "product_id": "CSAFPID-31017"
        },
        "product_reference": "CSAFPID-21009",
        "relates_to_product_reference": "CSAFPID-11017"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW11 installed on 750-823",
          "product_id": "CSAFPID-32001"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW11 after BACnet Certification installed on 750-332",
          "product_id": "CSAFPID-32002"
        },
        "product_reference": "CSAFPID-22002",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW11 after BACnet Certification installed on 750-832/xxx-xxx",
          "product_id": "CSAFPID-32003"
        },
        "product_reference": "CSAFPID-22002",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW11 installed on 750-862",
          "product_id": "CSAFPID-32004"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11013"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW11 installed on 750-890/xxx-xxx",
          "product_id": "CSAFPID-32005"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11014"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW11 installed on 750-891",
          "product_id": "CSAFPID-32006"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11015"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW11 installed on 750-893",
          "product_id": "CSAFPID-32007"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11016"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW17 installed on 750-829",
          "product_id": "CSAFPID-32008"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW17 installed on 750-852",
          "product_id": "CSAFPID-32009"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW17 installed on 750-880/xxx-xxx",
          "product_id": "CSAFPID-32010"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW17 installed on 750-881",
          "product_id": "CSAFPID-32011"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW17 installed on 750-882",
          "product_id": "CSAFPID-32012"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW17 installed on 750-885/xxx-xxx",
          "product_id": "CSAFPID-32013"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW17 installed on 750-889",
          "product_id": "CSAFPID-32014"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11008"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-31804",
      "cwe": {
        "id": "CWE-789",
        "name": "Memory Allocation with Excessive Size Value"
      },
      "notes": [
        {
          "category": "description",
          "text": "The CODESYS Gateway Server V2 does not verifiy that the size of a request is within expected limits. An unauthenticated attacker may allocate an arbitrary amount of memory, which may lead to a crash of the Gateway due to an out-of-memory condition.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8203/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8204/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8206/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8207/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8208/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8210/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8211/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8212/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8213/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8214/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8216/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8217/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 4th Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-823               | UPDATE B: Available in Q1 2024   |\n| 750-332               | UPDATE B: Available in Q1 2024   |\n| 750-832/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-862               | UPDATE B: Available in Q1 2024   |\n| 750-890/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-891               | UPDATE B: Available in Q1 2024   |\n| 750-893               | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 3rd Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-331               | UPDATE B: Available in Q1 2024   |\n| 750-829               | UPDATE B: Available in Q1 2024   |\n| 750-831/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-852               | UPDATE B: Available in Q1 2024   |\n| 750-880/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-881               | UPDATE B: Available in Q1 2024   |\n| 750-882               | UPDATE B: Available in Q1 2024   |\n| 750-885/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-889               | UPDATE B: Available in Q1 2024   |\n\n### Engineering Software\n\n| Name             | Firmware                         |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32  | UPDATE B: Available in Q1 2024   |",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017"
          ]
        }
      ],
      "title": "CVE-2022-31804"
    },
    {
      "cve": "CVE-2022-31803",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "description",
          "text": "In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP connections and prevent legitimate users or clients from establishing a new connection to the CODESYS Gateway Server V2. Existing connections are not affected and therefore remain intact.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8203/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8204/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8206/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8207/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8208/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8210/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8211/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8212/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8213/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8214/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8216/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8217/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 4th Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-823               | UPDATE B: Available in Q1 2024   |\n| 750-332               | UPDATE B: Available in Q1 2024   |\n| 750-832/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-862               | UPDATE B: Available in Q1 2024   |\n| 750-890/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-891               | UPDATE B: Available in Q1 2024   |\n| 750-893               | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 3rd Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-331               | UPDATE B: Available in Q1 2024   |\n| 750-829               | UPDATE B: Available in Q1 2024   |\n| 750-831/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-852               | UPDATE B: Available in Q1 2024   |\n| 750-880/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-881               | UPDATE B: Available in Q1 2024   |\n| 750-882               | UPDATE B: Available in Q1 2024   |\n| 750-885/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-889               | UPDATE B: Available in Q1 2024   |\n\n### Engineering Software\n\n| Name             | Firmware                         |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32  | UPDATE B: Available in Q1 2024   |",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.3,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017"
          ]
        }
      ],
      "title": "CVE-2022-31803"
    },
    {
      "cve": "CVE-2022-31802",
      "cwe": {
        "id": "CWE-187",
        "name": "Partial String Comparison"
      },
      "notes": [
        {
          "category": "description",
          "text": "In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gateway password.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8203/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8204/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8206/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8207/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8208/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8210/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8211/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8212/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8213/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8214/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8216/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8217/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 4th Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-823               | UPDATE B: Available in Q1 2024   |\n| 750-332               | UPDATE B: Available in Q1 2024   |\n| 750-832/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-862               | UPDATE B: Available in Q1 2024   |\n| 750-890/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-891               | UPDATE B: Available in Q1 2024   |\n| 750-893               | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 3rd Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-331               | UPDATE B: Available in Q1 2024   |\n| 750-829               | UPDATE B: Available in Q1 2024   |\n| 750-831/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-852               | UPDATE B: Available in Q1 2024   |\n| 750-880/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-881               | UPDATE B: Available in Q1 2024   |\n| 750-882               | UPDATE B: Available in Q1 2024   |\n| 750-885/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-889               | UPDATE B: Available in Q1 2024   |\n\n### Engineering Software\n\n| Name             | Firmware                         |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32  | UPDATE B: Available in Q1 2024   |",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017"
          ]
        }
      ],
      "title": "CVE-2022-31802"
    },
    {
      "cve": "CVE-2022-31806",
      "cwe": {
        "id": "CWE-1188",
        "name": "Initialization of a Resource with an Insecure Default"
      },
      "notes": [
        {
          "category": "description",
          "text": "In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8203/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8204/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8206/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8207/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8208/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8210/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8211/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8212/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8213/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8214/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8216/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8217/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 4th Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-823               | UPDATE B: Available in Q1 2024   |\n| 750-332               | UPDATE B: Available in Q1 2024   |\n| 750-832/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-862               | UPDATE B: Available in Q1 2024   |\n| 750-890/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-891               | UPDATE B: Available in Q1 2024   |\n| 750-893               | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 3rd Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-331               | UPDATE B: Available in Q1 2024   |\n| 750-829               | UPDATE B: Available in Q1 2024   |\n| 750-831/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-852               | UPDATE B: Available in Q1 2024   |\n| 750-880/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-881               | UPDATE B: Available in Q1 2024   |\n| 750-882               | UPDATE B: Available in Q1 2024   |\n| 750-885/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-889               | UPDATE B: Available in Q1 2024   |\n\n### Engineering Software\n\n| Name             | Firmware                         |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32  | UPDATE B: Available in Q1 2024   |",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017"
          ]
        }
      ],
      "title": "CVE-2022-31806"
    },
    {
      "cve": "CVE-2022-31805",
      "cwe": {
        "id": "CWE-523",
        "name": "Unprotected Transport of Credentials"
      },
      "notes": [
        {
          "category": "description",
          "text": "In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8203/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8204/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8206/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8207/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8208/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8210/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8211/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8212/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8213/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8214/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8216/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8217/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 4th Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-823               | UPDATE B: Available in Q1 2024   |\n| 750-332               | UPDATE B: Available in Q1 2024   |\n| 750-832/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-862               | UPDATE B: Available in Q1 2024   |\n| 750-890/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-891               | UPDATE B: Available in Q1 2024   |\n| 750-893               | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 3rd Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-331               | UPDATE B: Available in Q1 2024   |\n| 750-829               | UPDATE B: Available in Q1 2024   |\n| 750-831/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-852               | UPDATE B: Available in Q1 2024   |\n| 750-880/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-881               | UPDATE B: Available in Q1 2024   |\n| 750-882               | UPDATE B: Available in Q1 2024   |\n| 750-885/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-889               | UPDATE B: Available in Q1 2024   |\n\n### Engineering Software\n\n| Name             | Firmware                         |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32  | UPDATE B: Available in Q1 2024   |",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017"
          ]
        }
      ],
      "title": "CVE-2022-31805"
    },
    {
      "cve": "CVE-2022-32143",
      "cwe": {
        "id": "CWE-552",
        "name": "Files or Directories Accessible to External Parties"
      },
      "notes": [
        {
          "category": "description",
          "text": "In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller only if no level 1 password is configured on the controller or if remote attacker has previously successfully authenticated himself to the controller. A successful Attack may lead to a denial of service, change of local files, or drain of confidential Information. User interaction is not required",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8203/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8204/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8206/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8207/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8208/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8210/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8211/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8212/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8213/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8214/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8216/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8217/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 4th Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-823               | UPDATE B: Available in Q1 2024   |\n| 750-332               | UPDATE B: Available in Q1 2024   |\n| 750-832/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-862               | UPDATE B: Available in Q1 2024   |\n| 750-890/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-891               | UPDATE B: Available in Q1 2024   |\n| 750-893               | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 3rd Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-331               | UPDATE B: Available in Q1 2024   |\n| 750-829               | UPDATE B: Available in Q1 2024   |\n| 750-831/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-852               | UPDATE B: Available in Q1 2024   |\n| 750-880/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-881               | UPDATE B: Available in Q1 2024   |\n| 750-882               | UPDATE B: Available in Q1 2024   |\n| 750-885/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-889               | UPDATE B: Available in Q1 2024   |\n\n### Engineering Software\n\n| Name             | Firmware                         |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32  | UPDATE B: Available in Q1 2024   |",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017"
          ]
        }
      ],
      "title": "CVE-2022-32143"
    },
    {
      "cve": "CVE-2022-32142",
      "cwe": {
        "id": "CWE-823",
        "name": "Use of Out-of-range Pointer Offset"
      },
      "notes": [
        {
          "category": "description",
          "text": "Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which can cause an out-of-bounds read or write access, resulting in denial-of-service condition or local memory overwrite, which can lead to a change of local files. User interaction is not required.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8203/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8204/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8206/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8207/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8208/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8210/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8211/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8212/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8213/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8214/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8216/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8217/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 4th Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-823               | UPDATE B: Available in Q1 2024   |\n| 750-332               | UPDATE B: Available in Q1 2024   |\n| 750-832/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-862               | UPDATE B: Available in Q1 2024   |\n| 750-890/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-891               | UPDATE B: Available in Q1 2024   |\n| 750-893               | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 3rd Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-331               | UPDATE B: Available in Q1 2024   |\n| 750-829               | UPDATE B: Available in Q1 2024   |\n| 750-831/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-852               | UPDATE B: Available in Q1 2024   |\n| 750-880/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-881               | UPDATE B: Available in Q1 2024   |\n| 750-882               | UPDATE B: Available in Q1 2024   |\n| 750-885/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-889               | UPDATE B: Available in Q1 2024   |\n\n### Engineering Software\n\n| Name             | Firmware                         |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32  | UPDATE B: Available in Q1 2024   |",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 8.1,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 8.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017"
          ]
        }
      ],
      "title": "CVE-2022-32142"
    },
    {
      "cve": "CVE-2022-32141",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "description",
          "text": "Multiple CODESYS Products are prone to a buffer over read. A low privileged remote attacker may craft a request with an invalid offset, which can cause an internal buffer over-read, resulting in a denial-of-service condition. User interaction is not required.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8203/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8204/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8206/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8207/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8208/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8210/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8211/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8212/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8213/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8214/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8216/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8217/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 4th Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-823               | UPDATE B: Available in Q1 2024   |\n| 750-332               | UPDATE B: Available in Q1 2024   |\n| 750-832/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-862               | UPDATE B: Available in Q1 2024   |\n| 750-890/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-891               | UPDATE B: Available in Q1 2024   |\n| 750-893               | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 3rd Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-331               | UPDATE B: Available in Q1 2024   |\n| 750-829               | UPDATE B: Available in Q1 2024   |\n| 750-831/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-852               | UPDATE B: Available in Q1 2024   |\n| 750-880/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-881               | UPDATE B: Available in Q1 2024   |\n| 750-882               | UPDATE B: Available in Q1 2024   |\n| 750-885/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-889               | UPDATE B: Available in Q1 2024   |\n\n### Engineering Software\n\n| Name             | Firmware                         |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32  | UPDATE B: Available in Q1 2024   |",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017"
          ]
        }
      ],
      "title": "CVE-2022-32141"
    },
    {
      "cve": "CVE-2022-32140",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "Multiple CODESYS products are affected to a buffer overflow.A low privileged remote attacker may craft a request, which can cause a buffer copy without checking the size of the service, resulting in a denial-of-service condition. User Interaction is not required.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8203/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8204/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8206/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8207/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8208/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8210/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8211/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8212/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8213/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8214/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8216/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8217/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 4th Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-823               | UPDATE B: Available in Q1 2024   |\n| 750-332               | UPDATE B: Available in Q1 2024   |\n| 750-832/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-862               | UPDATE B: Available in Q1 2024   |\n| 750-890/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-891               | UPDATE B: Available in Q1 2024   |\n| 750-893               | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 3rd Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-331               | UPDATE B: Available in Q1 2024   |\n| 750-829               | UPDATE B: Available in Q1 2024   |\n| 750-831/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-852               | UPDATE B: Available in Q1 2024   |\n| 750-880/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-881               | UPDATE B: Available in Q1 2024   |\n| 750-882               | UPDATE B: Available in Q1 2024   |\n| 750-885/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-889               | UPDATE B: Available in Q1 2024   |\n\n### Engineering Software\n\n| Name             | Firmware                         |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32  | UPDATE B: Available in Q1 2024   |",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017"
          ]
        }
      ],
      "title": "CVE-2022-32140"
    },
    {
      "cve": "CVE-2022-32139",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "description",
          "text": "In multiple CODESYS products, a low privileged remote attacker may craft a request, which cause an out-of-bounds read, resulting in a denial-of-service condition. User Interaction is not required.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8203/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8204/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8206/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8207/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8208/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8210/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8211/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8212/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8213/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8214/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8216/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8217/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 4th Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-823               | UPDATE B: Available in Q1 2024   |\n| 750-332               | UPDATE B: Available in Q1 2024   |\n| 750-832/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-862               | UPDATE B: Available in Q1 2024   |\n| 750-890/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-891               | UPDATE B: Available in Q1 2024   |\n| 750-893               | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 3rd Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-331               | UPDATE B: Available in Q1 2024   |\n| 750-829               | UPDATE B: Available in Q1 2024   |\n| 750-831/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-852               | UPDATE B: Available in Q1 2024   |\n| 750-880/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-881               | UPDATE B: Available in Q1 2024   |\n| 750-882               | UPDATE B: Available in Q1 2024   |\n| 750-885/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-889               | UPDATE B: Available in Q1 2024   |\n\n### Engineering Software\n\n| Name             | Firmware                         |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32  | UPDATE B: Available in Q1 2024   |",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017"
          ]
        }
      ],
      "title": "CVE-2022-32139"
    },
    {
      "cve": "CVE-2022-32138",
      "cwe": {
        "id": "CWE-194",
        "name": "Unexpected Sign Extension"
      },
      "notes": [
        {
          "category": "description",
          "text": "In multiple CODESYS products, a remote attacker may craft a request which may cause an unexpected sign extension, resulting in a denial-of-service condition or memory overwrite.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8203/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8204/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8206/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8207/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8208/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8210/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8211/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8212/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8213/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8214/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8216/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8217/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 4th Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-823               | UPDATE B: Available in Q1 2024   |\n| 750-332               | UPDATE B: Available in Q1 2024   |\n| 750-832/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-862               | UPDATE B: Available in Q1 2024   |\n| 750-890/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-891               | UPDATE B: Available in Q1 2024   |\n| 750-893               | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 3rd Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-331               | UPDATE B: Available in Q1 2024   |\n| 750-829               | UPDATE B: Available in Q1 2024   |\n| 750-831/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-852               | UPDATE B: Available in Q1 2024   |\n| 750-880/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-881               | UPDATE B: Available in Q1 2024   |\n| 750-882               | UPDATE B: Available in Q1 2024   |\n| 750-885/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-889               | UPDATE B: Available in Q1 2024   |\n\n### Engineering Software\n\n| Name             | Firmware                         |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32  | UPDATE B: Available in Q1 2024   |",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016"
          ]
        }
      ],
      "title": "CVE-2022-32138"
    },
    {
      "cve": "CVE-2022-32137",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-service condition or memory overwrite. User interaction is not required.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8203/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8204/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8206/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8207/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8208/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8210/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8211/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8212/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8213/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8214/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8216/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8217/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 4th Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-823               | UPDATE B: Available in Q1 2024   |\n| 750-332               | UPDATE B: Available in Q1 2024   |\n| 750-832/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-862               | UPDATE B: Available in Q1 2024   |\n| 750-890/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-891               | UPDATE B: Available in Q1 2024   |\n| 750-893               | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 3rd Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-331               | UPDATE B: Available in Q1 2024   |\n| 750-829               | UPDATE B: Available in Q1 2024   |\n| 750-831/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-852               | UPDATE B: Available in Q1 2024   |\n| 750-880/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-881               | UPDATE B: Available in Q1 2024   |\n| 750-882               | UPDATE B: Available in Q1 2024   |\n| 750-885/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-889               | UPDATE B: Available in Q1 2024   |\n\n### Engineering Software\n\n| Name             | Firmware                         |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32  | UPDATE B: Available in Q1 2024   |",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017"
          ]
        }
      ],
      "title": "CVE-2022-32137"
    },
    {
      "cve": "CVE-2022-32136",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "notes": [
        {
          "category": "description",
          "text": "In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-of-service. User interaction is not required.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8203/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8204/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8206/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8207/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8208/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8210/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8211/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8212/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8213/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8214/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8216/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8217/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 4th Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-823               | UPDATE B: Available in Q1 2024   |\n| 750-332               | UPDATE B: Available in Q1 2024   |\n| 750-832/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-862               | UPDATE B: Available in Q1 2024   |\n| 750-890/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-891               | UPDATE B: Available in Q1 2024   |\n| 750-893               | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 3rd Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-331               | UPDATE B: Available in Q1 2024   |\n| 750-829               | UPDATE B: Available in Q1 2024   |\n| 750-831/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-852               | UPDATE B: Available in Q1 2024   |\n| 750-880/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-881               | UPDATE B: Available in Q1 2024   |\n| 750-882               | UPDATE B: Available in Q1 2024   |\n| 750-885/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-889               | UPDATE B: Available in Q1 2024   |\n\n### Engineering Software\n\n| Name             | Firmware                         |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32  | UPDATE B: Available in Q1 2024   |",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017"
          ]
        }
      ],
      "title": "CVE-2022-32136"
    },
    {
      "cve": "CVE-2022-1965",
      "cwe": {
        "id": "CWE-755",
        "name": "Improper Handling of Exceptional Conditions"
      },
      "notes": [
        {
          "category": "description",
          "text": "Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8203/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8204/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8206/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8207/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8208/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8210/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8211/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8212/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8213/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8214/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8216/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n| 750-8217/xxx-xxx      | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 4th Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-823               | UPDATE B: Available in Q1 2024   |\n| 750-332               | UPDATE B: Available in Q1 2024   |\n| 750-832/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-862               | UPDATE B: Available in Q1 2024   |\n| 750-890/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-891               | UPDATE B: Available in Q1 2024   |\n| 750-893               | UPDATE B: Available in Q1 2024   |\n\n### Ethernet Controller 3rd Generation Family \u2013 UPDATE B\n\n| Ord. No.              | Firmware                         |\n|-----------------------|----------------------------------|\n| 750-331               | UPDATE B: Available in Q1 2024   |\n| 750-829               | UPDATE B: Available in Q1 2024   |\n| 750-831/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-852               | UPDATE B: Available in Q1 2024   |\n| 750-880/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-881               | UPDATE B: Available in Q1 2024   |\n| 750-882               | UPDATE B: Available in Q1 2024   |\n| 750-885/xxx-xxx       | UPDATE B: Available in Q1 2024   |\n| 750-889               | UPDATE B: Available in Q1 2024   |\n\n### Engineering Software\n\n| Name             | Firmware                         |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32  | UPDATE B: Available in Q1 2024   |",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 8.1,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 8.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017"
          ]
        }
      ],
      "title": "CVE-2022-1965"
    }
  ]
}