8.8
Élevée
CVE-2022-32143 In multiple CODESYS products, file download and upload function allows access to internal files in the working directory…
Description
In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller only if no level 1 password is configured on the controller or if remote attacker has previously successfully authenticated himself to the controller. A successful Attack may lead to a denial of service, change of local files, or drain of confidential Information. User interaction is not required
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Runtime Toolkit 2 | 2 → < 2.4.7.57 | 2.4.7.57 |
| PLCWinNT 2 | 2 → < 2.4.7.57 | 2.4.7.57 |
Autres CVE de Runtime Toolkit
Les 13 CVE de Runtime Toolkit →
CVE-2026-76992
The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate…
8.7
Élevée
CVE-2026-79625
Affected products do not properly synchronize access to their monitoring functionality
7.2
Élevée
CVE-2025-41659
A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and…
8.3
Élevée
CVE-2025-41658
CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due…
5.5
Moyenne