Details of VAR-202207-0490

ID

VAR-202207-0490

CVE

CVE-2022-30791

TITLE

plural CODESYS GmbH Product resource exhaustion vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-012665

DESCRIPTION

In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing connections are not affected. control for beaglebone , control for empc-a/imx6 , CODESYS Control for IOT2000 SL etc. multiple CODESYS GmbH The product contains a resource exhaustion vulnerability.Service operation interruption (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2022-30791 // JVNDB: JVNDB-2022-012665 // VULHUB: VHN-422575 // VULMON: CVE-2022-30791

AFFECTED PRODUCTS

vendor:	codesys	model:	control for empc-a\/imx6	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	control for iot2000 sl	scope:	lt	version:	4.6.0.0	Trust: 1.0
vendor:	codesys	model:	control for wago touch panels 600	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	control for pfc200 sl	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	control for beaglebone	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	control rte sl \	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	control for linux sl	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	remote target visu toolkit	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	control for raspberry pi sl	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	edge gateway	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	development system	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	gateway	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	control rte sl	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	edge gateway	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	control for pfc100 sl	scope:	lt	version:	4.5.0.0	Trust: 1.0
vendor:	codesys	model:	embedded target visu toolkit	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	control runtime system toolkit	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	control for plcnext	scope:	lt	version:	4.6.0.0	Trust: 1.0
vendor:	codesys	model:	hmi	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	control win	scope:	lt	version:	3.5.18.20	Trust: 1.0
vendor:	codesys	model:	control for iot2000 sl	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	embedded target visu toolkit	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for beaglebone	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for linux sl	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for pfc100 sl	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	gateway	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control win	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control rte v3	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control rte sl	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for wago touch panels 600	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for empc-a/imx6	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	edge gateway	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	remote target visu toolkit	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control runtime system toolkit	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	hmi	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for plcnext	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	development system	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for pfc200 sl	scope:	-	version:	-	Trust: 0.8
vendor:	codesys	model:	control for raspberry pi sl	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-012665 // NVD: CVE-2022-30791

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-30791
value:	HIGH
Trust: 1.0
info@cert.vde.com:	CVE-2022-30791
value:	HIGH
Trust: 1.0
NVD:	CVE-2022-30791
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202207-787
value:	HIGH
Trust: 0.6
VULHUB:	VHN-422575
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2022-30791
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2022-30791
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-422575
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2022-30791
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 2.0
OTHER:	JVNDB-2022-012665
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-422575 // VULMON: CVE-2022-30791 // JVNDB: JVNDB-2022-012665 // CNNVD: CNNVD-202207-787 // NVD: CVE-2022-30791 // NVD: CVE-2022-30791

PROBLEMTYPE DATA

problemtype:	CWE-400	Trust: 1.1
problemtype:	Resource exhaustion (CWE-400) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-422575 // JVNDB: JVNDB-2022-012665 // NVD: CVE-2022-30791

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202207-787

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202207-787

PATCH

title:

3S-Smart Software Solutions CODESYS Remediation of resource management error vulnerabilities

url:

http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=200893

Trust: 0.6

sources: CNNVD: CNNVD-202207-787

EXTERNAL IDS

db:	NVD	id:	CVE-2022-30791	Trust: 3.4
db:	JVNDB	id:	JVNDB-2022-012665	Trust: 0.8
db:	CNNVD	id:	CNNVD-202207-787	Trust: 0.6
db:	VULHUB	id:	VHN-422575	Trust: 0.1
db:	VULMON	id:	CVE-2022-30791	Trust: 0.1

sources: VULHUB: VHN-422575 // VULMON: CVE-2022-30791 // JVNDB: JVNDB-2022-012665 // CNNVD: CNNVD-202207-787 // NVD: CVE-2022-30791

REFERENCES

url:	https://customers.codesys.com/index.php?eid=dumpfile&t=f&f=17128&token=bee4d8a57f19be289d623ec90135493b5f9179e3&download=	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2022-30791	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-30791/	Trust: 0.6
url:	https://customers.codesys.com/index.php?eid=dumpfile&t=f&f=17128&token=bee4d8a57f19be289d623ec90135493b5f9179e3&download=	Trust: 0.1
url:	https://cwe.mitre.org/data/definitions/400.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-422575 // VULMON: CVE-2022-30791 // JVNDB: JVNDB-2022-012665 // CNNVD: CNNVD-202207-787 // NVD: CVE-2022-30791

SOURCES

db:	VULHUB	id:	VHN-422575
db:	VULMON	id:	CVE-2022-30791
db:	JVNDB	id:	JVNDB-2022-012665
db:	CNNVD	id:	CNNVD-202207-787
db:	NVD	id:	CVE-2022-30791

LAST UPDATE DATE

2024-08-14T13:22:03.238000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-422575	date:	2022-09-23T00:00:00
db:	VULMON	id:	CVE-2022-30791	date:	2022-07-20T00:00:00
db:	JVNDB	id:	JVNDB-2022-012665	date:	2023-08-31T08:32:00
db:	CNNVD	id:	CNNVD-202207-787	date:	2022-07-21T00:00:00
db:	NVD	id:	CVE-2022-30791	date:	2022-09-23T16:26:08.200

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-422575	date:	2022-07-11T00:00:00
db:	VULMON	id:	CVE-2022-30791	date:	2022-07-11T00:00:00
db:	JVNDB	id:	JVNDB-2022-012665	date:	2023-08-31T00:00:00
db:	CNNVD	id:	CNNVD-202207-787	date:	2022-07-11T00:00:00
db:	NVD	id:	CVE-2022-30791	date:	2022-07-11T11:15:08.177