{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-19T21:45:13.738","vulnerabilities":[{"cve":{"id":"CVE-2022-32143","sourceIdentifier":"info@cert.vde.com","published":"2022-06-24T08:15:08.167","lastModified":"2024-11-21T07:05:50.140","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller only if no level 1 password is configured on the controller or if remote attacker has previously successfully authenticated himself to the controller. A successful Attack may lead to a denial of service, change of local files, or drain of confidential Information. User interaction is not required"},{"lang":"es","value":"En Diversos productos CODESYS, la función de descarga y carga de archivos permite el acceso a archivos internos en el directorio de trabajo, por ejemplo, archivos de firmware del PLC. Todas las peticiones son procesadas en el controlador sólo si no presenta una contraseña de nivel 1 configurada en el controlador o si el atacante remoto ha sido autenticado previamente con éxito en el controlador. Un ataque con éxito puede conllevar a una denegación de servicio, la modificación de los archivos locales o un filtrado de información confidencial. No es requerida una interacción del usuario"}],"metrics":{"cvssMetricV31":[{"source":"info@cert.vde.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"info@cert.vde.com","type":"Secondary","description":[{"lang":"en","value":"CWE-552"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:codesys:plcwinnt:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0","versionEndExcluding":"2.4.7.57","matchCriteriaId":"2B26FF87-3FCD-496E-97C5-A1E4F6AACCB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:x86:*","versionStartIncluding":"2.0","versionEndExcluding":"2.4.7.57","matchCriteriaId":"CF74E74E-4EF8-4C84-A9A1-612AB7FC88BA"}]}]}],"references":[{"url":"https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=","source":"info@cert.vde.com","tags":["Mitigation","Vendor Advisory"]},{"url":"https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Vendor Advisory"]}]}}]}