Back to Database
Status published
High
CVE-2022-4224
CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3
Vulnerability Description
In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-4224
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Franklin Zhao from ELEX FEIGONG RESEARCH INSTITUTE of Elex CyberSecurity
- Reid Wightman of Dragos
More from CODESYS
View All →CVE-2025-41739
CODESYS Control - Linux/QNX SysSocket flaw
Medium
5.9
CVE-2025-41738
CODESYS Control - Invalid type usage in visualization
High
7.5
CVE-2025-41700
CODESYS Development System - Deserialization of Untrusted Data
High
7.8
CVE-2025-41691
CODESYS Control DoS via Unauthenticated NULL Pointer Dereference
High
7.5
CVE-2025-41660
CODESYS Control Boot Application Replacement Enables Code Execution
High
8.8
Affected Vendor
CODESYS
View all reports →Affected Software
Control RTE (SL) , Control RTE (for Beckhoff CX) SL, Control Win (SL), Runtime Toolkit , Safety SIL2 Runtime Toolkit, Safety SIL2 PSP, HMI (SL) , Development System V3, Control for BeagleBone SL , Control for emPC-A/iMX6 SL, Control for IOT2000 SL, Control for Linux SL, Control for PFC100 SL, Control for PFC200 SL, Control for PLCnext SL, Control for Raspberry Pi SL, Control for WAGO Touch Panels 600 SL
Vulnerable Versions:
3.0.0.0
Timeline
Official Publish:
March 23rd, 2023
Last Modified:
May 29th, 2026
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.