Details of VAR-202207-0363

ID

VAR-202207-0363

CVE

CVE-2022-30792

TITLE

plural CODESYS GmbH Product resource exhaustion vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-012664

DESCRIPTION

In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel connections. Existing connections are not affected. control for beaglebone , control for empc-a/imx6 , CODESYS Control for IOT2000 SL etc. multiple CODESYS GmbH The product contains a resource exhaustion vulnerability.Service operation interruption (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2022-30792 // JVNDB: JVNDB-2022-012664 // VULHUB: VHN-422576 // VULMON: CVE-2022-30792

AFFECTED PRODUCTS

vendor:	codesys	model:	control for empc-a\/imx6	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	control for iot2000 sl	scope:	lt	version:	4.6.0.0	Trust: 1.0
vendor:	codesys	model:	control for wago touch panels 600	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	control for pfc200 sl	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	control for beaglebone	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	control rte sl \	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	control for linux sl	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	remote target visu toolkit	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	control for raspberry pi sl	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	edge gateway	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	development system	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	gateway	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	control rte sl	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	edge gateway	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	control for pfc100 sl	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	embedded target visu toolkit	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	control runtime system toolkit	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	control for plcnext	scope:	lt	version:	4.6.0.0	Trust: 1.0
vendor:	codesys	model:	hmi	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	control win	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	control for iot2000 sl	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	embedded target visu toolkit	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for beaglebone	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for linux sl	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for pfc100 sl	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	gateway	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control win	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control rte v3	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control rte sl	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for wago touch panels 600	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for empc-a/imx6	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	edge gateway	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	remote target visu toolkit	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control runtime system toolkit	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	hmi	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for plcnext	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	development system	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for pfc200 sl	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for raspberry pi sl	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-012664 // NVD: CVE-2022-30792

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-30792
value:	HIGH
Trust: 1.0
info@cert.vde.com:	CVE-2022-30792
value:	HIGH
Trust: 1.0
NVD:	CVE-2022-30792
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202207-791
value:	HIGH
Trust: 0.6
VULHUB:	VHN-422576
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2022-30792
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2022-30792
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-422576
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2022-30792
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 2.0
OTHER:	JVNDB-2022-012664
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-422576 // VULMON: CVE-2022-30792 // JVNDB: JVNDB-2022-012664 // CNNVD: CNNVD-202207-791 // NVD: CVE-2022-30792 // NVD: CVE-2022-30792

PROBLEMTYPE DATA

problemtype:	CWE-400	Trust: 1.1
problemtype:	Resource exhaustion (CWE-400) [ others ]	Trust: 0.8

sources: VULHUB: VHN-422576 // JVNDB: JVNDB-2022-012664 // NVD: CVE-2022-30792

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202207-791

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202207-791

PATCH

title:

3S-Smart Software Solutions CODESYS Remediation of resource management error vulnerabilities

url:

http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=200895

Trust: 0.6

sources: CNNVD: CNNVD-202207-791

EXTERNAL IDS

db:	NVD	id:	CVE-2022-30792	Trust: 3.4
db:	JVNDB	id:	JVNDB-2022-012664	Trust: 0.8
db:	CNNVD	id:	CNNVD-202207-791	Trust: 0.6
db:	VULHUB	id:	VHN-422576	Trust: 0.1
db:	VULMON	id:	CVE-2022-30792	Trust: 0.1

sources: VULHUB: VHN-422576 // VULMON: CVE-2022-30792 // JVNDB: JVNDB-2022-012664 // CNNVD: CNNVD-202207-791 // NVD: CVE-2022-30792

REFERENCES

url:	https://customers.codesys.com/index.php?eid=dumpfile&t=f&f=17128&token=bee4d8a57f19be289d623ec90135493b5f9179e3&download=	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2022-30792	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-30792/	Trust: 0.6
url:	https://customers.codesys.com/index.php?eid=dumpfile&t=f&f=17128&token=bee4d8a57f19be289d623ec90135493b5f9179e3&download=	Trust: 0.1
url:	https://cwe.mitre.org/data/definitions/400.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-422576 // VULMON: CVE-2022-30792 // JVNDB: JVNDB-2022-012664 // CNNVD: CNNVD-202207-791 // NVD: CVE-2022-30792

SOURCES

db:	VULHUB	id:	VHN-422576
db:	VULMON	id:	CVE-2022-30792
db:	JVNDB	id:	JVNDB-2022-012664
db:	CNNVD	id:	CNNVD-202207-791
db:	NVD	id:	CVE-2022-30792

LAST UPDATE DATE

2024-08-14T15:00:54.926000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-422576	date:	2022-09-23T00:00:00
db:	VULMON	id:	CVE-2022-30792	date:	2022-07-20T00:00:00
db:	JVNDB	id:	JVNDB-2022-012664	date:	2023-08-31T08:31:00
db:	CNNVD	id:	CNNVD-202207-791	date:	2022-07-21T00:00:00
db:	NVD	id:	CVE-2022-30792	date:	2022-09-23T16:25:41.847

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-422576	date:	2022-07-11T00:00:00
db:	VULMON	id:	CVE-2022-30792	date:	2022-07-11T00:00:00
db:	JVNDB	id:	JVNDB-2022-012664	date:	2023-08-31T00:00:00
db:	CNNVD	id:	CNNVD-202207-791	date:	2022-07-11T00:00:00
db:	NVD	id:	CVE-2022-30792	date:	2022-07-11T11:15:08.240