Critical severity9.8NVD Advisory· Published Jun 24, 2022· Updated Jun 17, 2026

CVE-2022-31802

Description

In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gateway password.

Affected products

Codesys/Gateway V3
cpe:2.3:a:codesys:gateway:*:*:*:*:*:*:*:*
Range: >=2.0,<2.3.9.38
Codesys/Gateway Server V2llm-fuzzy
Range: <2.3.9.38
Codesys/3s Smart Codesys Gateway Servercpe-rescue
Range: V2

Patches

Vulnerability mechanics

References

customers.codesys.com/index.phpnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000