CyberSecBulletin
CVE-2022-1965NVD status: Modified

Runtime Toolkit: Improper Handling of Exceptional Conditions

Published Updated By the CyberSecBulletin desk

CVE-2022-1965 is a high-severity improper handling of exceptional conditions vulnerability in Runtime Toolkit from Codesys, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists version V2.4.7.57 as the first without the flaw, so updating Runtime Toolkit to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 1.09% chance of exploitation within 30 days, higher than 66% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Runtime Toolkit to V2.4.7.57 or a later version.
  2. Update PLCWinNT to V2.4.7.57 or a later version.
  3. Read the advisory on customers.codesys.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
CODESYSRuntime ToolkitV2 up to, but not including, V2.4.7.57V2.4.7.57
CODESYSPLCWinNTV2 up to, but not including, V2.4.7.57V2.4.7.57

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.18.1HighCNA (cert.vde.com)
CVSS 3.18.1HighNVD
CVSS 2.05.5MediumNVD

Official description

Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

More Improper Handling of Exceptional Conditions vulnerabilities (CWE-755)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Runtime Toolkit

All Runtime Toolkit vulnerabilities

Recent Improper Handling of Exceptional Conditions vulnerabilities

Spotted an error? Tell us.