← Vulnerability feed

Vulnerability record · CVE-2022-31802 · published 24 June 2022

CVE-2022-31802: Codesys gateway vulnerability

Codesys · Gateway

In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gateway password.

9.8 CVSS 3.1 Critical EPSS 1.3% · top 30.7% CWE-187 · CWE-187
9.8CVSS 3.1 base score, v2 7.5
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gateway password.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17141&token=17867e35cfd30c77ba0137f9a17b3a557a4b7b66&download Vendor Advisory
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17141&token=17867e35cfd30c77ba0137f9a17b3a557a4b7b66&download Vendor Advisory

Track CVE-2022-31802 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-9010Codesys control for beaglebone sl vulnerabilityAn issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All …EPSS 1.9%7.5CVE-2022-30791Codesys control for beaglebone uncontrolled resource consumption vulnerabilityIn CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections…EPSS 0.89%7.5CVE-2022-30792Codesys control for beaglebone uncontrolled resource consumption vulnerabilityIn CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communicati…EPSS 0.89%7.5CVE-2022-31804Codesys gateway vulnerabilityThe CODESYS Gateway Server V2 does not verifiy that the size of a request is within expected limits. An unauthenticated attacker may allocate an arbi…EPSS 1.1%7.5CVE-2022-31805Codesys development system vulnerabilityIn the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers u…EPSS 1.0%7.5CVE-2022-22517Codesys control for beaglebone sl vulnerabilityAn unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting…EPSS 1.3%7.5CVE-2021-36764Codesys gateway null pointer dereference vulnerabilityIn CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer dereference in t…EPSS 0.99%7.5CVE-2021-29241Codesys control for beaglebone sl null pointer dereference vulnerabilityCODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).EPSS 1.4%

Source: NIST National Vulnerability Database (record CVE-2022-31802), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.