CVE-2022-31806 CRITICAL

CVE-2022-31806: Insecure default settings in CODESYS Runtime Toolkit 32 bit full and CODESYS PLCWinNT

Vendor Codesys
Product CODESYS PLCWinNT
Weakness CWE-1188
Published June 24, 2022
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller.

Key dates

02Disclosure timeline

June 24, 2022 CVE published
September 17, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2018-25193 Mongoose Web Server 6.9 Denial of Service via Socket Connection CVE-2026-34742 Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost CVE-2026-39920 BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE CVE-2026-30805 Insecure Default Initialization in API Authentication leads to Authentication Bypass CVE-2026-44109 OpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validation