CVE-2022-47391
📋 TL;DR
CVE-2022-47391 is an improper input validation vulnerability in multiple CODESYS products that allows unauthorized remote attackers to read from invalid memory addresses, potentially causing denial of service. This affects industrial control systems using vulnerable CODESYS software versions.
💻 Affected Systems
- CODESYS Control runtime systems
- CODESYS Development System
- CODESYS Gateway
📦 What is this software?
Control For Wago Touch Panels 600 Sl by Codesys
View all CVEs affecting Control For Wago Touch Panels 600 Sl →
Control Rte \(for Beckhoff Cx\) Sl by Codesys
View all CVEs affecting Control Rte \(for Beckhoff Cx\) Sl →
Hmi Sl by Codesys
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or unavailability of industrial control systems leading to production downtime
Likely Case
Service disruption of CODESYS applications causing temporary operational impact
If Mitigated
Minimal impact with proper network segmentation and access controls
🎯 Exploit Status
Vulnerability requires network access to CODESYS services but no authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V3.5.19.0 and later
Vendor Advisory: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17555&token=212fc7e39bdd260cab6d6ca84333d42f50bcb3da&download=
Restart Required: Yes
Instructions:
1. Download latest CODESYS version from vendor portal 2. Backup current configuration 3. Install update following vendor instructions 4. Restart affected systems 5. Verify functionality
🔧 Temporary Workarounds
Network Segmentation
allIsolate CODESYS systems from untrusted networks
Service Restriction
allDisable unnecessary CODESYS network services
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Monitor systems for abnormal behavior and implement compensating controls
🔍 How to Verify
Check if Vulnerable:
Check CODESYS version against affected versions list in vendor advisoryCheck Version:
Check CODESYS About dialog or version files in installation directoryVerify Fix Applied:
Verify installed version is V3.5.19.0 or later📡 Detection & Monitoring
Log Indicators:
- Unexpected service restarts
- Memory access errors in system logs
- Connection attempts to CODESYS ports
Network Indicators:
- Traffic to CODESYS default ports (1217, 2455, etc.) from unauthorized sources
- Abnormal packet patterns to CODESYS services
SIEM Query:
source_port IN (1217, 2455) AND dest_ip IN (CODESYS_IPS) AND NOT src_ip IN (ALLOWED_NETWORKS)