CVE-2022-31802
Critical
Description
In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gateway password.
SeverityCritical
CVSS9.8
Exploit probability—
ProductCodesys Gateway
PublishedJun 24, 2022
First seenJun 24, 2022
Weakness typeCWE-187CWE-187
How to fix
Update
- codesys gateway2.3.9.38 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| codesys gateway | 2.0 ≤ v < 2.3.9.38 | 2.3.9.38 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.