CVE-2022-22515
A component of the CODESYS Control runtime system allows read and write access to configuration files
CVE-2022-22515 is a high vulnerability (CVSS 8.1) in Codesys Control For Beaglebone Sl, published April 7, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.29%, the 70th percentile. No source names a fixed version.
- Severity
- 8.1 HighCVSS 3.1, CVE List
- Exploit chance
- 1.29%EPSS, 70th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
Affected products
- codesys control for beaglebone sl
- codesys control for beckhoff cx9020 sl
- codesys control for empc-a/imx6 sl
- codesys control for iot2000 sl
- codesys control for linux sl
- codesys control for pfc100 sl
- codesys control for pfc200 sl
- codesys control for plcnext sl
- codesys control for raspberry pi sl
- codesys control for wago touch panels 600 sl
- codesys control rte (for beckhoff cx) sl
- codesys control rte (sl)
Show 13 moreShow less
- codesys control runtime system toolkit
- codesys control win (sl)
- codesys development system v3
- codesys embedded target visu toolkit
- codesys hmi (sl)
- codesys remote target visu toolkit
- codesys control for beckhoff cx9020
- codesys control for empc-a\/imx6 sl
- codesys control rte sl
- codesys control rte sl \(for beckhoff cx\)
- codesys control win sl
- codesys development system
- codesys hmi sl
What each source reports
CVE List Score used
A component of the CODESYS Control runtime system allows read and write access to configuration files
A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.
- Record
CVE-2022-22515- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-668
- Updated
- 2026-11-02
EUVDEUVD-2022-27661
A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.
- Record
EUVD-2022-27661- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v4p3-h3rx-q79h
A remote, unauthenticated attacker could utilize the control programmer of the CODESYS Control...
A remote, unauthenticated attacker could utilize the control programmer of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.
- Record
GHSA-v4p3-h3rx-q79h- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-668
- Updated
- 2026-11-02
NVD
A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.
- Record
CVE-2022-22515- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:N - Weakness
- CWE-668
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.