Login Request a demo
High severity · published Apr 7, 2022
CVE-2022-22516
The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Control Rte SL · Codesys
before 3.5.18.0 · source: NVD
CR
Control Rte SL (for Beckhoff Cx) · Codesys
before 3.5.18.0 · source: NVD
CW
Control Win SL · Codesys
before 3.5.18.0 · source: NVD
DS
Development System · Codesys
before 3.5.18.0 · source: NVD
Affected product
CR
Control Rte SL
Codesys
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-22516
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-22516
Vendor Advisory
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17090&token=6cd08b169916366df31388d2e7ba58e7bce93508&download=
More from Control Rte SL
9.8
CVE-2018-10612
In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which…
8.8
CVE-2022-4046
In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access…
8.8
CVE-2022-47390
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write…
8.8
CVE-2022-47389
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write…
8.8
CVE-2022-47388
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write…