Skip to content
Sign in
8.8 High

CVE-2022-32143 In multiple CODESYS products, file download and upload function allows access to internal files in the working directory…

Description

In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller only if no level 1 password is configured on the controller or if remote attacker has previously successfully authenticated himself to the controller. A successful Attack may lead to a denial of service, change of local files, or drain of confidential Information. User interaction is not required

Affected products and versions

Product Affected versions Fixed in
Runtime Toolkit 2 2 → < 2.4.7.57 2.4.7.57
PLCWinNT 2 2 → < 2.4.7.57 2.4.7.57

Other CVEs of Runtime Toolkit

The 13 CVEs of Runtime Toolkit →
CVE-2026-76992 The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate… 8.7 High CVE-2026-79625 Affected products do not properly synchronize access to their monitoring functionality 7.2 High CVE-2025-41659 A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and… 8.3 High CVE-2025-41658 CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due… 5.5 Medium
Track this CVE