CVE-2022-31806
Last modified
CVE-2022-31806 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller.. EPSS estimates a 1.12% chance of exploitation in the next 30 days.
Description
In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Codesys | Plcwinnt | < 2.4.7.57 |
| Codesys | Runtime Toolkit | < 2.4.7.57 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-31806?
How severe is CVE-2022-31806?
How do I fix CVE-2022-31806?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-31800An unauthenticated, remote attacker could upload malicious l…9.8
- CVE-2022-31801An unauthenticated, remote attacker could upload malicious l…9.8
- CVE-2022-31802In CODESYS Gateway Server V2 for versions prior to V2.3.9.38…9.8
- CVE-2022-31803In CODESYS Gateway Server V2 an insufficient check for the a…5.3
- CVE-2022-31804The CODESYS Gateway Server V2 does not verifiy that the size…7.5
- CVE-2022-31805In the CODESYS Development System multiple components in mul…7.5
- CVE-2022-31807A vulnerability has been identified in Building X - Security…5.5
- CVE-2022-31808A vulnerability has been identified in SiPass integrated AC5…7.8
- CVE-2022-3181An Improper Input Validation vulnerability exists in Trihedr…7.5
- CVE-2022-31810A vulnerability has been identified in SiPass integrated (Al…7.5
- CVE-2022-31812A vulnerability has been identified in SiPass integrated (Al…8.7
- CVE-2022-31813Apache HTTP Server 2.4.53 and earlier may not send the X-For…9.8
Are you affected by CVE-2022-31806?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST