Skip to content
Fencer Vulns
high 8.1

CVE-2022-22515 json

A component of the CODESYS Control runtime system allows read and write access to configuration files

published 2022-04-07 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-27661

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits
0
none known

Summary

A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.

Patch / fix

  • CODESYS CODESYS Control RTE (SL) V3.5.17.40
  • CODESYS CODESYS Control RTE (for Beckhoff CX) SL V3.5.17.40
  • CODESYS CODESYS Control Win (SL) V3.5.17.40
  • CODESYS CODESYS HMI (SL) V3.5.17.40
  • CODESYS CODESYS Development System V3 V3.5.17.40
  • CODESYS CODESYS Control Runtime System Toolkit V3.5.17.40
  • CODESYS CODESYS Embedded Target Visu Toolkit V3.5.17.40
  • CODESYS CODESYS Remote Target Visu Toolkit V3.5.17.40
  • CODESYS CODESYS Control for BeagleBone SL V4.5.0.0
  • CODESYS CODESYS Control for Beckhoff CX9020 SL V4.5.0.0
  • CODESYS CODESYS Control for emPC-A/iMX6 SL V4.5.0.0
  • CODESYS CODESYS Control for IOT2000 SL V4.5.0.0
  • CODESYS CODESYS Control for Linux SL V4.5.0.0
  • CODESYS CODESYS Control for PFC100 SL V4.5.0.0
  • CODESYS CODESYS Control for PFC200 SL V4.5.0.0
  • CODESYS CODESYS Control for PLCnext SL V4.5.0.0
  • CODESYS CODESYS Control for Raspberry Pi SL V4.5.0.0
  • CODESYS CODESYS Control for WAGO Touch Panels 600 SL V4.5.0.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-076-01 updated cvss 8.1

CODESYS in Festo Automation Suite

  • CODESYS Development System 3.0 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138 CODESYS Development System 3.5.16.10 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138
    affected: mitigation
  • Festo Automation Suite 2.8.0.138 CODESYS Development System 3.5.21.20
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-329-05 updated cvss 8.1

Festo Compact Vision System, Control Block, Controller, and Operator Unit products

  • Festo -Q- -Q- Festo Software Compact Vision System SBO-Q- Festo Software Control block CPX-CEC Codesys V2 Festo Software Control block CPX-CEC-C1 Codesys V2 Festo Software Control block CPX-CEC-C1-V3 Codesys V3 Festo Software Control block CPX-CEC-M1 Codesys V2
    +27 more products
    Festo Software Control block CPX-CEC-M1-V3 Codesys V3 Festo Software Control block CPX-CEC-S1-V3 Codesys V3 Festo Software Control block CPX-CMXX Festo Software Controller CECC-D Festo Software Controller CECC-D-BA Festo Software Controller CECC-D-CS Festo Software Controller CECC-LK Festo Software Controller CECC-S Festo Software Controller CECC-X-M1 Festo Software Controller CECC-X-M1-MV Festo Software Controller CECC-X-M1-S1 Festo Software Controller CECX-X-C1 Festo Software Controller CECX-X-M1 Festo Software Controller CPX-E-CEC-C1 Festo Software Controller CPX-E-CEC-C1-EP Festo Software Controller CPX-E-CEC-C1-PN Festo Software Controller CPX-E-CEC-M1 Festo Software Controller CPX-E-CEC-M1-EP Festo Software Controller CPX-E-CEC-M1-PN Festo Software Controller FED-CEC Festo Software Operator unit CDPX-X-A-S-10 Festo Software Operator unit CDPX-X-A-W-4 Festo Software Operator unit CDPX-X-A-W-7 Festo Software Operator unit CDPX-X-A-W-13 Festo Software Operator unit CDPX-X-E1-W-7 Festo Software Operator unit CDPX-X-E1-W-10 Festo Software Operator unit CDPX-X-E1-W-15
    affected: mitigation “Festo has identified the following specific workarounds and mitigations users can apply to reduce risk:” certvde.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-25-273-04 updated cvss 8.1

Festo Controller CECC-S,-LK,-D Family Firmware (Update A)

  • Festo Firmware (R05 (17.06.2016) = 2.3.8.0) installed on Festo Hardware Controller CECC-D (All versions) Festo Firmware (R05 (17.06.2016) = 2.3.8.0) installed on Festo Hardware Controller CECC-S (All versions) Festo Firmware (R06 (11.10.2016) = 2.3.8.1) installed on Festo Hardware Controller CECC-LK (All versions) Festo Firmware (R06 (11.10.2016) = 2.3.8.1) installed on Festo Hardware Controller CECC-S (All versions)
    affected: mitigation “Festo has identified the following specific workarounds and mitigations users can apply to reduce risk:” certvde.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.29% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N

Affected products

  • CODESYS CODESYS Control RTE (SL)
  • CODESYS CODESYS Control RTE (for Beckhoff CX) SL
  • CODESYS CODESYS Control Win (SL)
  • CODESYS CODESYS HMI (SL)
  • CODESYS CODESYS Development System V3
  • CODESYS CODESYS Control Runtime System Toolkit
  • CODESYS CODESYS Embedded Target Visu Toolkit
  • CODESYS CODESYS Remote Target Visu Toolkit
  • CODESYS CODESYS Control for BeagleBone SL
  • CODESYS CODESYS Control for Beckhoff CX9020 SL
  • CODESYS CODESYS Control for emPC-A/iMX6 SL
  • CODESYS CODESYS Control for IOT2000 SL
  • CODESYS CODESYS Control for Linux SL
  • CODESYS CODESYS Control for PFC100 SL
  • CODESYS CODESYS Control for PFC200 SL
  • CODESYS CODESYS Control for PLCnext SL
  • CODESYS CODESYS Control for Raspberry Pi SL
  • CODESYS CODESYS Control for WAGO Touch Panels 600 SL

Classification

Weakness
  • CWE-668 Exposure of Resource to Wrong Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.