CVE-2022-32143

In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller only if no level 1 password is configured on the controller or if remote attacker has previously successfully authenticated himself to the controller. A successful Attack may lead to a denial of service, change of local files, or drain of confidential Information. User interaction is not required

• CWE-552

• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=Mitigation, Vendor Advisory
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=Mitigation, Vendor Advisory

Published

Jun 24, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-32138In multiple CODESYS products, a remote attacker may craft a …8.8
• CVE-2022-32139In multiple CODESYS products, a low privileged remote attack…6.5
• CVE-2022-3214Delta Industrial Automation's DIAEnergy, an industrial energ…9.8
• CVE-2022-32140Multiple CODESYS products are affected to a buffer overflow.…6.5
• CVE-2022-32141Multiple CODESYS Products are prone to a buffer over read. A…6.5
• CVE-2022-32142Multiple CODESYS Products are prone to a out-of bounds read …8.1
• CVE-2022-32144There is an insufficient input verification vulnerability in…8.6
• CVE-2022-32145A vulnerability has been identified in Teamcenter Active Wor…6.1
• CVE-2022-32147Rejected reason: reserved but not needed
• CVE-2022-32148Improper exposure of client IP addresses in net/http before …6.5
• CVE-2022-32149An attacker may cause a denial of service by crafting an Acc…7.5
• CVE-2022-3215NIOHTTP1 and projects using it for generating HTTP responses…7.5