CVE-2022-30791

In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing connections are not affected.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17128&token=bee4d8a57f19be289d623ec90135493b5f9179e3&download=	Vendor Advisory
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17128&token=bee4d8a57f19be289d623ec90135493b5f9179e3&download=	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:codesys:control_for_beaglebone::::::::
	cpe:2.3:a:codesys:control_for_empc-a\/imx6::::::::
	cpe:2.3:a:codesys:control_for_iot2000_sl::::::::
	cpe:2.3:a:codesys:control_for_linux_sl::::::::
	cpe:2.3:a:codesys:control_for_pfc100_sl::::::::
	cpe:2.3:a:codesys:control_for_pfc200_sl::::::::
	cpe:2.3:a:codesys:control_for_plcnext::::::::
	cpe:2.3:a:codesys:control_for_raspberry_pi_sl::::::::
	cpe:2.3:a:codesys:control_for_wago_touch_panels_600::::::::
	cpe:2.3:a:codesys:control_rte_sl::::::::
	cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\)::::::::
	cpe:2.3:a:codesys:control_runtime_system_toolkit::::::::
	cpe:2.3:a:codesys:control_win::::::::
	cpe:2.3:a:codesys:development_system::::::::
	cpe:2.3:a:codesys:edge_gateway::::::windows::*
	cpe:2.3:a:codesys:edge_gateway::::::linux::*
	cpe:2.3:a:codesys:embedded_target_visu_toolkit::::::::
	cpe:2.3:a:codesys:gateway::::::::
	cpe:2.3:a:codesys:hmi::::::::
	cpe:2.3:a:codesys:remote_target_visu_toolkit::::::::

History

21 Nov 2024, 07:03

Type	Values Removed	Values Added
References	~~() https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17128&token=bee4d8a57f19be289d623ec90135493b5f9179e3&download= - Vendor Advisory~~	() https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17128&token=bee4d8a57f19be289d623ec90135493b5f9179e3&download= - Vendor Advisory

Information

Published : 2022-07-11 11:15

Updated : 2024-11-21 07:03

NVD link : CVE-2022-30791

Mitre link : CVE-2022-30791

CVE.ORG link : CVE-2022-30791

JSON object : View

Products Affected

codesys

control_for_empc-a\/imx6
control_runtime_system_toolkit
control_for_linux_sl
control_for_iot2000_sl
development_system
control_for_beaglebone
control_for_raspberry_pi_sl
control_for_wago_touch_panels_600
hmi
control_for_pfc200_sl
gateway
embedded_target_visu_toolkit
remote_target_visu_toolkit
control_rte_sl
edge_gateway
control_for_pfc100_sl
control_rte_sl_\(for_beckhoff_cx\)
control_win
control_for_plcnext

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2022-30791", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-07-11T11:15:08.177", "references": [{"url": "https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17128&token=bee4d8a57f19be289d623ec90135493b5f9179e3&download=", "tags": ["Vendor Advisory"], "source": "info@cert.vde.com"}, {"url": "https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17128&token=bee4d8a57f19be289d623ec90135493b5f9179e3&download=", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing connections are not affected."}, {"lang": "es", "value": "En CmpBlkDrvTcp de CODESYS versi\u00f3n V3 en m\u00faltiples versiones un consumo no controlado de recursos permite a un atacante no autorizado bloquear nuevas conexiones TCP. Las conexiones existentes no est\u00e1n afectadas"}], "lastModified": "2024-11-21T07:03:23.800", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:codesys:control_for_beaglebone:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5D6E827-7AD1-4248-82E6-C879771A2FBA", "versionEndExcluding": "4.5.0.0"}, {"criteria": "cpe:2.3:a:codesys:control_for_empc-a\\/imx6:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E07464D3-D8E5-45CC-8703-B445A866F015", "versionEndExcluding": "4.5.0.0"}, {"criteria": "cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD1474A7-A282-4929-A9E4-721322DCAE15", "versionEndExcluding": "4.6.0.0"}, {"criteria": "cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB585AB5-D0AC-46DC-9723-A0FEFBFB015C", "versionEndExcluding": "4.5.0.0"}, {"criteria": "cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F6E2A1D-0187-4C71-A87D-48B3EC3D99DD", "versionEndExcluding": "4.5.0.0"}, {"criteria": "cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A78E493B-6D9E-4196-830C-24BCF25D3D44", "versionEndExcluding": "4.5.0.0"}, {"criteria": "cpe:2.3:a:codesys:control_for_plcnext:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD0BCA34-FE68-4933-B189-746D2DA3E062", "versionEndExcluding": "4.6.0.0"}, {"criteria": "cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D5DE9D1-C334-452C-A64B-D74A48017B6D", "versionEndExcluding": "4.5.0.0"}, {"criteria": "cpe:2.3:a:codesys:control_for_wago_touch_panels_600:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "966AEA54-4939-4C84-8D8B-7C70D361555B", "versionEndExcluding": "4.5.0.0"}, {"criteria": "cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A33E4442-F316-439F-83BD-047A34EF6E14", "versionEndExcluding": "3.5.18.20"}, {"criteria": "cpe:2.3:a:codesys:control_rte_sl_\\(for_beckhoff_cx\\):*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8AC245C1-F19D-417A-801E-D08B0ED81651", "versionEndExcluding": "3.5.18.20"}, {"criteria": "cpe:2.3:a:codesys:control_runtime_system_toolkit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1A0B9C6-534C-4D2C-BC62-620786CE748F", "versionEndExcluding": "3.5.18.20"}, {"criteria": "cpe:2.3:a:codesys:control_win:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22F16730-93D3-41D4-B5D0-F507BC2D5A03", "versionEndExcluding": "3.5.18.20"}, {"criteria": "cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05792C1C-C4BB-4084-96A3-69544076F944", "versionEndExcluding": "3.5.18.20"}, {"criteria": "cpe:2.3:a:codesys:edge_gateway:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "6C919501-6AFE-4D4C-84EF-C6AF30EBB769", "versionEndExcluding": "3.5.18.20"}, {"criteria": "cpe:2.3:a:codesys:edge_gateway:*:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "E36291AE-21CB-4ECB-8816-D50712C70E30", "versionEndExcluding": "4.5.0.0"}, {"criteria": "cpe:2.3:a:codesys:embedded_target_visu_toolkit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26B19D43-1A55-45E5-9C0A-00E9487B4282", "versionEndExcluding": "3.5.18.20"}, {"criteria": "cpe:2.3:a:codesys:gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73C1F863-AAC0-446A-98E1-436916DA66B9", "versionEndExcluding": "3.5.18.20"}, {"criteria": "cpe:2.3:a:codesys:hmi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C26E9A35-AEB3-4856-8410-989D422A6D95", "versionEndExcluding": "3.5.18.20"}, {"criteria": "cpe:2.3:a:codesys:remote_target_visu_toolkit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26CA4951-7DD0-4477-8C36-EC07191CAC8F", "versionEndExcluding": "3.5.18.20"}], "operator": "OR"}]}], "sourceIdentifier": "info@cert.vde.com"}

7.5 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0 /10

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

JSON object

Attach tags to CVE-2022-30791

7.5^/10

5.0^/10

Attach tags to `CVE-2022-30791`