CVE-2022-1989: CODESYS Visualization vulnerable to user enumeration

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-23 · updated 2026-06-17
Weakness: CWE-204

Description

All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to enumerate valid users.

Affected products

CODESYS Visualization: from 4.0.0.0 before 4.2.0.0 — fixed in 4.2.0.0

How to fix

Upgrade to a fixed version: CODESYS Visualization 4.2.0.0. Check the vendor advisory for mitigations.

References

https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17142&token=a3696ab41fef800d2eaee8043d40d5fbe94277fd&download=
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17142&token=a3696ab41fef800d2eaee8043d40d5fbe94277fd&download=

Get alerted when CVE-2022-1989 or the next vulnerability affects your stack