CVE-2022-32142 CODESYS runtime system prone to denial of service due to use of out of range pointer

High 8.1 Published 24 Jun 2022 Updated 17 Sep 2024

A remote attacker can cause denial of service or local file modification in CODESYS runtime systems via crafted requests with invalid offsets.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-32142?

CVE-2022-32142 is a high-severity memory corruption vulnerability in CODESYS PLCWinNT, published on 24 Jun 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which can cause an out-of-bounds read or write access, resulting in denial-of-service condition or local memory overwrite, which can lead to a change of local files. User interaction is not required.

Weakness: CWE-823

Which versions are affected by CVE-2022-32142?

It affects 2 products.

Products include Codesys Plcwinnt, Codesys Runtime Toolkit.

How do I fix CVE-2022-32142?

No fix has been published for CVE-2022-32142 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-32142 being exploited?

There is no known exploitation of CVE-2022-32142 in the wild and no public exploit code.

Sources

Also known as GHSA-jv3v-7c3q-8hh2.