CVE-2022-31806
📋 TL;DR
CODESYS V2 PLCWinNT and Runtime Toolkit 32 versions before V2.4.7.57 have password protection disabled by default with no prompt to enable it. This allows unauthorized access to industrial control systems. Affected users are those running vulnerable CODESYS software in industrial environments.
💻 Affected Systems
- CODESYS V2 PLCWinNT
- CODESYS Runtime Toolkit 32
📦 What is this software?
Plcwinnt by Codesys
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full control of industrial PLCs, potentially causing physical damage, production shutdowns, or safety incidents.
Likely Case
Unauthorized access to PLC programming and configuration, leading to operational disruption or data theft.
If Mitigated
Limited impact with proper network segmentation and access controls in place.
🎯 Exploit Status
No authentication required when password protection is disabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V2.4.7.57
Vendor Advisory: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17140&token=6aa2c5c4a8b83b8b09936fefed5b0b11f9d2cc6c&download=
Restart Required: Yes
Instructions:
1. Download V2.4.7.57 from CODESYS customer portal. 2. Install update on affected systems. 3. Restart CODESYS services. 4. Enable password protection in configuration.
🔧 Temporary Workarounds
Enable Password Protection
windowsManually enable password protection in CODESYS configuration.
Configure via CODESYS Control Panel or configuration files
Network Segmentation
allIsolate CODESYS systems from untrusted networks.
Implement firewall rules to restrict access to CODESYS ports
🧯 If You Can't Patch
- Enable password protection immediately in all CODESYS instances
- Implement strict network access controls and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check CODESYS version in About dialog or registry: HKEY_LOCAL_MACHINE\SOFTWARE\3S-Smart Software Solutions\CODESYS\VersionCheck Version:
reg query "HKLM\SOFTWARE\3S-Smart Software Solutions\CODESYS" /v VersionVerify Fix Applied:
Verify version is V2.4.7.57 or later and password protection is enabled in configuration.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to CODESYS services
- Configuration changes without authentication
Network Indicators:
- Unexpected connections to CODESYS ports (typically 1217, 1740)
SIEM Query:
source="CODESYS" AND (event_type="login" AND user="anonymous" OR event_type="config_change" AND auth_status="none")