CVE-2022-22508 CODESYS V3: Improper Input Validation
An authenticated remote attacker can block consecutive logins of a specific type in CODESYS V3 products, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-22508?
CVE-2022-22508 is a medium-severity denial of service vulnerability in Codesys Control for Beaglebone Sl, published on 15 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type.
Weakness: CWE-20
Which versions are affected by CVE-2022-22508?
It affects 14 products.
Products include Codesys Control for Beaglebone Sl, Codesys Control for Empc-A\/Imx6 Sl, Codesys Control for Iot2000 Sl, Codesys Control for Linux Sl, Codesys Control for Pfc100 Sl, Codesys Control for Pfc200 Sl and 8 more.
How do I fix CVE-2022-22508?
No fix has been published for CVE-2022-22508 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-22508 being exploited?
There is no known exploitation of CVE-2022-22508 in the wild and no public exploit code.
Other vulnerabilities in Codesys Control for Beaglebone Sl
- CVE-2019-9010 Missing authorization in n/a
- CVE-2018-10612 Misconfiguration in 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0
- CVE-2023-6357 OS Command Injection in multiple CODESYS products
- CVE-2022-4046 CODESYS: Improper memory restrictions fro CODESYS Control
- CVE-2022-47379 CODESYS: Multiple products prone to out-of-bounds write
Sources
Also known as GHSA-r25h-c4pw-fm98.