Skip to content
Fencer Vulns
high 7.1

CVE-2022-22514 json

Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS.

published 2022-04-07 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-27660

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to local overwriting of memory in the CmpTraceMgr, whereby the attacker can neither gain the values read internally nor control the values to be written. If invalid memory is accessed, this results in a crash.

Patch / fix

  • codesys control_for_beaglebone_sl 4.5.0.0
  • codesys control_for_beckhoff_cx9020 4.5.0.0
  • codesys control_for_empc-a/imx6_sl 4.5.0.0
  • codesys control_for_iot2000_sl 4.5.0.0
  • codesys control_for_linux_sl 4.5.0.0
  • codesys control_for_pfc100_sl 4.5.0.0
  • codesys control_for_pfc200_sl 4.5.0.0
  • codesys control_for_plcnext_sl 4.5.0.0
  • codesys control_for_raspberry_pi_sl 4.5.0.0
  • codesys control_for_wago_touch_panels_600_sl 4.5.0.0
  • codesys control_rte_sl 3.5.18.0
  • codesys control_rte_sl_(for_beckhoff_cx) 3.5.18.0
  • codesys control_runtime_system_toolkit 3.5.18.0
  • codesys control_win_sl 3.5.18.0
  • codesys development_system 3.5.18.0
  • codesys edge_gateway 3.5.18.0, 4.5.0.0
  • codesys embedded_target_visu_toolkit 3.5.18.0
  • codesys gateway 3.5.18.0
  • codesys hmi_sl 3.5.18.0
  • codesys remote_target_visu_toolkit 3.5.18.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-076-01 updated cvss 7.1

CODESYS in Festo Automation Suite

  • CODESYS Development System 3.0 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138 CODESYS Development System 3.5.16.10 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138
    affected: mitigation
  • Festo Automation Suite 2.8.0.138 CODESYS Development System 3.5.21.20
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-273-04 updated cvss 7.1

Festo Controller CECC-S,-LK,-D Family Firmware (Update A)

  • Festo Firmware (R05 (17.06.2016) = 2.3.8.0) installed on Festo Hardware Controller CECC-D (All versions) Festo Firmware (R05 (17.06.2016) = 2.3.8.0) installed on Festo Hardware Controller CECC-S (All versions) Festo Firmware (R06 (11.10.2016) = 2.3.8.1) installed on Festo Hardware Controller CECC-LK (All versions) Festo Firmware (R06 (11.10.2016) = 2.3.8.1) installed on Festo Hardware Controller CECC-S (All versions)
    affected: mitigation “Festo has identified the following specific workarounds and mitigations users can apply to reduce risk:” certvde.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
NVD 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
NVD 2.0 4.9 AV:N/AC:M/Au:S/C:N/I:P/A:P

Affected products

  • CODESYS CODESYS Control RTE (SL)
  • CODESYS CODESYS Control RTE (for Beckhoff CX) SL
  • CODESYS CODESYS Control Win (SL)
  • CODESYS CODESYS Gateway
  • CODESYS CODESYS Edge Gateway for Windows
  • CODESYS CODESYS HMI (SL)
  • CODESYS CODESYS Development System V3
  • CODESYS CODESYS Control Runtime System Toolkit
  • CODESYS CODESYS Embedded Target Visu Toolkit
  • CODESYS CODESYS Remote Target Visu Toolkit
  • CODESYS CODESYS Control for BeagleBone SL
  • CODESYS CODESYS Control for Beckhoff CX9020 SL
  • CODESYS CODESYS Control for emPC-A/iMX6 SL
  • CODESYS CODESYS Control for IOT2000 SL
  • CODESYS CODESYS Control for Linux SL
  • CODESYS CODESYS Control for PFC100 SL
  • CODESYS CODESYS Control for PFC200 SL
  • CODESYS CODESYS Control for PLCnext SL
  • CODESYS CODESYS Control for Raspberry Pi SL
  • CODESYS CODESYS Control for WAGO Touch Panels 600 SL
  • CODESYS CODESYS Edge Gateway for Linux

Classification

Weakness
  • CWE-822 Untrusted Pointer Dereference
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.