CVE-2022-31805

Insecure transmission of credentials

Description

In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.

Category

7.5
CVSS
Severity: High
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.26%
Vendor Advisory codesys.com
Affected: CODESYS CODESYS Development System
Affected: CODESYS CODESYS Gateway Client
Affected: CODESYS CODESYS Gateway Server
Affected: CODESYS CODESYS Web server
Affected: CODESYS CODESYS SP Realtime NT
Affected: CODESYS CODESYS PLCWinNT
Affected: CODESYS CODESYS Runtime Toolkit 32 bit full
Affected: CODESYS CODESYS Edge Gateway for Windows
Affected: CODESYS CODESYS HMI (SL)
Affected: CODESYS CODESYS OPC DA Server SL
Affected: CODESYS CODESYS PLCHandler
Affected: CODESYS CODESYS Gateway
Published at:
Updated at:

References

Link Tags
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17140&token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c&download= vendor advisory

Frequently Asked Questions

What is the severity of CVE-2022-31805?
CVE-2022-31805 has been scored as a high severity vulnerability.
How to fix CVE-2022-31805?
To fix CVE-2022-31805, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-31805 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2022-31805 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-31805?
CVE-2022-31805 affects CODESYS CODESYS Development System, CODESYS CODESYS Gateway Client, CODESYS CODESYS Gateway Server, CODESYS CODESYS Web server, CODESYS CODESYS SP Realtime NT, CODESYS CODESYS PLCWinNT, CODESYS CODESYS Runtime Toolkit 32 bit full, CODESYS CODESYS Edge Gateway for Windows, CODESYS CODESYS HMI (SL), CODESYS CODESYS OPC DA Server SL, CODESYS CODESYS PLCHandler, CODESYS CODESYS Gateway.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.