CODESYS Gateway Server V2: Partial String Comparison
CVE-2022-31802 is a high-severity partial string comparison vulnerability in CODESYS Gateway Server V2 from Codesys, with a CVSS 2.0 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version V2.3.9.38 as the first without the flaw, so updating CODESYS Gateway Server V2 to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 1.35% chance of exploitation within 30 days, higher than 72% of scored CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update CODESYS Gateway Server V2 to V2.3.9.38 or a later version.
- Update Gateway to 2.3.9.38 or a later version.
- Read the advisory on customers.codesys.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| CODESYS | CODESYS Gateway Server V2 | V2 up to, but not including, V2.3.9.38 | V2.3.9.38 |
| Codesys | Gateway | 2.0 up to, but not including, 2.3.9.38 | 2.3.9.38 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Access vector
- NetworkCan be exploited remotely over a network.
- Access complexity
- LowNo special conditions are needed.
- Authentication
- NoneNo login is needed.
- Confidentiality
- PartialSome data can be read.
- Integrity
- PartialSome data can be modified.
- Availability
- PartialAvailability is reduced.
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 9.8 | Critical | CNA (cert.vde.com) |
| CVSS 2.0 | 7.5 | High | NVD |
Official description
In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gateway password.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Partial String Comparison
The product performs a string comparison that only examines a portion of the string before determining whether there is a match.
How developers prevent this class of flaw
- Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Spotted an error? Tell us.