CVE-2022-31805: Insecure transmission of credentials

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-24 · updated 2026-06-17
Weakness: CWE-523

Description

In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.

Affected products

CODESYS Development System: before 2.3.9.69 — fixed in 2.3.9.69
CODESYS Edge Gateway: before 3.5.18.30 — fixed in 3.5.18.30
CODESYS Gateway Server V2: before 2.3.9.38 — fixed in 2.3.9.38
CODESYS HMI (SL): before 3.5.18.30 — fixed in 3.5.18.30
CODESYS Opc Server: before 3.5.18.30 — fixed in 3.5.18.30
CODESYS PLCHandler: before 3.5.18.30 — fixed in 3.5.18.30
CODESYS PLCWinNT: before 2.4.7.57 — fixed in 2.4.7.57
CODESYS Runtime Toolkit: before 2.4.7.57 — fixed in 2.4.7.57
CODESYS Sp Realtime Nt: before 2.3.7.30 — fixed in 2.3.7.30
3S-Smart Software Solutions GmbH CODESYS Web Server: before 1.1.9.23 — fixed in 1.1.9.23

How to fix

Upgrade to a fixed version: CODESYS Development System 2.3.9.69; CODESYS Edge Gateway 3.5.18.30; CODESYS Gateway Server V2 2.3.9.38; CODESYS HMI (SL) 3.5.18.30; CODESYS Opc Server 3.5.18.30; CODESYS PLCHandler 3.5.18.30; CODESYS PLCWinNT 2.4.7.57; CODESYS Runtime Toolkit 2.4.7.57; CODESYS Sp Realtime Nt 2.3.7.30; 3S-Smart Software Solutions GmbH CODESYS Web Server 1.1.9.23. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-31805 or the next vulnerability affects your stack