CVE-2022-31805
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedIn the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceThe CODESYS Development System transmits client-server authentication passwords in cleartext (unencrypted), allowing network eavesdropping to capture credentials. This affects multiple components across multiple versions of the development environment.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 2.3.9.69< 3.5.18.30< 2.3.9.38< 3.5.18.30< 3.5.18.30< 3.5.18.30< 2.4.7.57< 2.4.7.57CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed CODESYS componentsReview installed programs or check Program Files for CODESYS directories (typically C:\Program Files\CODESYS or C:\Program Files (x86)\CODESYS). Look for component names: Development System, Edge Gateway, Gateway, Hmi Sl, Opc Server, Plchandler, Plcwinnt, Runtime Toolkit.Affected if Any CODESYS component from the affected product list is installed on the system.
-
Check CODESYS Development System versionOpen CODESYS Development System, go to Help > About, or locate the file Cv3Core.dll and check its version property. Compare the version number against 2.3.9.69.Affected if Version is lower than 2.3.9.69.
-
Check CODESYS Gateway versionLocate the Gateway executable (Gateway.exe or similar) in the installation directory. Right-click the file, select Properties, and check the File Version. Compare against 2.3.9.38.Affected if Version is lower than 2.3.9.38.
-
Check CODESYS Edge Gateway, Hmi Sl, Opc Server, and Plchandler versionsFind the respective executable files in their installation folders (typically named after each component). Check the File Version property of each executable. Compare each against 3.5.18.30.Affected if Any of these components have versions lower than 3.5.18.30.
-
Check CODESYS Plcwinnt and Runtime Toolkit versionsLocate Plcwinnt.exe or Runtime Toolkit binaries in the installation directory. Check the File Version property. Compare against 2.4.7.57.Affected if Version is lower than 2.4.7.57.
-
Verify if affected components are used for client-server communicationReview CODESYS project configurations and network settings. Determine whether the affected components are configured to communicate with remote clients or servers over the network (not isolated local-only operation).Affected if The vulnerable component is configured for network communication with remote systems.
A system is affected if any CODESYS component from the affected product list is installed with a version below the specified threshold AND the component handles client-server network communication.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped2.3.9.382.3.9.692.4.7.57
Apply vendor patches from CODESYS when available; until then, isolate affected systems on dedicated network segments and use VPN tunnels for all client-server communications involving CODESYS.
Upgrade to fixed versions: Development System >=2.3.9.69, Edge Gateway >=3.5.18.30, Gateway >=2.3.9.38, Hmi Sl >=3.5.18.30, Opc Server >=3.5.18.30, Plchandler >=3.5.18.30, Plcwinnt >=2.4.7.57, Runtime Toolkit >=2.4.7.57
- 1. Identify all installed CODESYS products from the affected list: Development System, Edge Gateway, Gateway, Hmi Sl, Opc Server, Plchandler, Plcwinnt, Runtime Toolkit
- 2. Check current installed versions of each product
- 3. For each affected product, download and install the fixed version: Development System version 2.3.9.69 or later, Edge Gateway version 3.5.18.30 or later, Gateway version 2.3.9.38 or later, Hmi Sl version 3.5.18.30 or later, Opc Server version 3.5.18.30 or later, Plchandler version 3.5.18.30 or later, Plcwinnt version 2.4.7.57 or later, Runtime Toolkit version 2.4.7.57 or later
- 4. Obtain the updates from the official source: customers.codesys.com
- 5. After upgrading, verify that client-server communications now use protected password transmission
- 6. Test all affected CODESYS applications to ensure normal functionality after the update
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation8.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2022-31805 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2022-31805 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data