CVE-2022-32142: codesys plcwinnt Use of Out-of-range Pointer Offset

Vulnerability summary

CVE-2022-32142 is a high (CVSS 8.1) Use of Out-of-range Pointer Offset vulnerability in codesys plcwinnt. EPSS estimates a 1.05% chance of exploitation in the next 30 days, higher than 63.8% of scored vulnerabilities.

Timeline

1. 24-06-2022
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which can cause an out-of-bounds read or write access, resulting in denial-of-service condition or local memory overwrite, which can lead to a change of local files. User interaction is not required.

• CWE-823Use of Out-of-range Pointer OffsetThe product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.