Skip to content
OpenAdvisories
Medium · 6.5 CVE-2022-22518 EUVD-2022-27664GHSA-m3jp-v66f-7qcp

A bug in the CODESYS V3 CmpUserMgr component fails to correctly apply a security policy.

Published Apr 7, 2022 · Updated Sep 17, 2024 · Assigned by CERTVDE

Vendor: CODESYS Product: CODESYS Control for BeagleBone SL Product: CODESYS Control for Beckhoff CX9020 SL Product: CODESYS Control for emPC-A/iMX6 SL Product: CODESYS Control for IOT2000 SL Product: CODESYS Control for Linux SL Product: CODESYS Control for PFC100 SL Product: CODESYS Control for PFC200 SL Product: CODESYS Control for Raspberry Pi SL Product: CODESYS Control for WAGO Touch Panels 600 SL Product: CODESYS Control Runtime System Toolkit Platform: Linux Category: ICS / OT

Description

A bug in CmpUserMgr component can lead to only partially applied security policies. This can result in enabled, anonymous access to components part of the applied security policy.

Affected products

VendorProductAffectedFixed
CODESYS CODESYS Control for BeagleBone SL V4.5.0.0 – < V4.5.0.0 V4.5.0.0
CODESYS CODESYS Control for Beckhoff CX9020 SL V4.5.0.0 – < V4.5.0.0 V4.5.0.0
CODESYS CODESYS Control for emPC-A/iMX6 SL V4.5.0.0 – < V4.5.0.0 V4.5.0.0
CODESYS CODESYS Control for IOT2000 SL V4.5.0.0 – < V4.5.0.0 V4.5.0.0
CODESYS CODESYS Control for Linux SL V4.5.0.0 – < V4.5.0.0 V4.5.0.0
CODESYS CODESYS Control for PFC100 SL V4.5.0.0 – < V4.5.0.0 V4.5.0.0
CODESYS CODESYS Control for PFC200 SL V4.5.0.0 – < V4.5.0.0 V4.5.0.0
CODESYS CODESYS Control for Raspberry Pi SL V4.5.0.0 – < V4.5.0.0 V4.5.0.0
CODESYS CODESYS Control for WAGO Touch Panels 600 SL V4.5.0.0 – < V4.5.0.0 V4.5.0.0
CODESYS CODESYS Control Runtime System Toolkit V3.5.18.0 – < V3.5.18.0 V3.5.18.0

References