by Kastro
Paper/Archive/CVE-2022-31802

CVE-2022-31802

CODESYS CODESYS Gateway Server V2 — Partial string comparison in CODESYS gateway server

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 71.1.711 × 2014.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gateway password.

Affected

ProductAffectedFixed inSource
CODESYS Gateway Server V2V2 – < V2.3.9.38V2.3.9.38CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refcustomers.codesys.com/index.php?eID=dumpFile&t=f&f=17141&token=17867e35cfd30c77ba0137f9a17b3a557a4b7b66&download=