CVE-2022-32136

CVE-2022-32136 affects multiple CODESYS products. A low-privilege remote attacker can craft a request to read an uninitialized pointer, causing a denial-of-service without user interaction. The root cause is dereferencing/uninitialized pointers. Impact is DoS; confidentiality/integrity unaffected...

CVE-2022-32139

CVE-2022-32139 affects multiple CODESYS products. An attacker with low privileges can remotely craft a request that triggers an out-of-bounds read, causing a denial-of-service condition without user interaction. The NVD and CVE records describe the impact but do not provide concrete details on af...

CVE-2022-32141

CVE-2022-32141 involves multiple CODESYS products with a buffer over-read caused by insufficient internal buffer read limits when processing a request with an invalid offset. This enables a low-privilege, remote attacker to trigger a denial-of-service condition without user interaction. The avail...

CVE-2022-1965

CVE-2022-1965 concerns multiple CODESYS products with an improper error handling flaw. A low-privilege, remote attacker can craft a network request that is not properly processed by the error handling, potentially causing deletion of the file referenced by that request. No user interaction is req...

CVE-2022-32142

CVE-2022-32142 affects multiple CODESYS products; an attacker with low privileges can craft requests with invalid offsets to trigger an out-of-bounds read/write, causing DoS or local memory overwrite and potentially changing local files. Descriptions consistently state no user interaction is requ...

CVE-2022-32140

CVE-2022-32140 affects multiple CODESYS products and describes a buffer overflow caused by an unchecked size during a buffer copy, allowing a low-privileged, remote attacker to trigger a denial-of-service condition without user interaction. The description indicates an attacker can craft a reques...

CVE-2022-32143

In CVE-2022-32143, multiple CODESYS products expose a file upload/download function that can access internal files in the working directory (e.g., PLC firmware). The issue is conditionally exploitable: requests are processed on the controller only if no level-1 password is configured or if the at...

CVE-2022-32137

In CVE-2022-32137, multiple CODESYS products are affected by a heap-based buffer overflow that an unauthenticated, low-privilege remote attacker can trigger by crafting a request. This condition can result in a Denial of Service or a memory overwrite, with no user interaction required. The NVD en...

CVE-2022-32138

CVE-2022-32138 affects multiple CODESYS products. A remote attacker can craft a request that triggers an unexpected sign extension, leading to denial-of-service or memory overwrite. The CVSS scores indicate high impact (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected detail on exact products, vers...