CVE-2022-47389
CODESYS: Multiple products prone to stack based out-of-bounds write
Reported by certvde · Published May 15, 2023
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| control_for_pfc100_sl | codesys | 4.8.0.0 |
| control_for_iot2000_sl | codesys | 4.8.0.0 |
| CODESYS Control for PFC100 SL | CODESYS | V4.8.0.0, 4.8.0.0 |
| CODESYS Control RTE (SL) | CODESYS | 3.5.19.0 |
| control_for_wago_touch_panels_600_sl | codesys | 4.8.0.0 |
| control_rte_\(sl\) | codesys | 3.5.19.0 |
| safety_sil2_psp | codesys | 3.5.19.0 |
| development_system_v3 | codesys | 3.5.19.0 |
| hmi_\(sl\) | codesys | 3.5.19.0 |
| control_win_\(sl\) | codesys | 3.5.19.0 |
| CODESYS Control for emPC-A/iMX6 SL | CODESYS | 4.8.0.0 |
| CODESYS Control for WAGO Touch Panels 600 SL | CODESYS | V4.8.0.0, 4.8.0.0 |
22 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| CODESYS | CODESYS Control RTE (SL) | V0.0.0.0 |
| CODESYS | CODESYS Control RTE (for Beckhoff CX) SL | V0.0.0.0 |
| CODESYS | CODESYS Control Win (SL) | V0.0.0.0 |
| CODESYS | CODESYS Control Runtime System Toolkit | V0.0.0.0 |
| CODESYS | CODESYS Safety SIL2 Runtime Toolkit | V0.0.0.0 |
| CODESYS | CODESYS Safety SIL2 PSP | V0.0.0.0 |
| CODESYS | CODESYS HMI (SL) | V0.0.0.0 |
| CODESYS | CODESYS Development System V3 | V0.0.0.0 |
| CODESYS | CODESYS Control for BeagleBone SL | V0.0.0.0 |
| CODESYS | CODESYS Control for emPC-A/iMX6 SL | V0.0.0.0 |
| CODESYS | CODESYS Control for IOT2000 SL | V0.0.0.0 |
| CODESYS | CODESYS Control for Linux SL | V0.0.0.0 |
| CODESYS | CODESYS Control for PFC100 SL | V0.0.0.0 |
| CODESYS | CODESYS Control for PFC200 SL | V0.0.0.0 |
| CODESYS | CODESYS Control for PLCnext SL | V0.0.0.0 |
| CODESYS | CODESYS Control for Raspberry Pi SL | V0.0.0.0 |
| CODESYS | CODESYS Control for WAGO Touch Panels 600 SL | V0.0.0.0 |
| CODESYS | CODESYS Control RTE (SL) | 0.0.0.0 |
| CODESYS | CODESYS Safety SIL2 PSP | 0.0.0.0 |
| CODESYS | CODESYS Control for Linux SL | 0.0.0.0 |
…and 14 more
Timeline
- May 15, 2023 CVE Published
- May 16, 2023 EPSS Score (30 in total, the first dated here)
- Jul 17, 2025 CVE Updated
- Mar 17, 2026 PoC Published (2 in total, the first dated here)
- May 3, 2026 Security Advisory
- May 24, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2022-47389
vulnetix vdb fixes CVE-2022-47389Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2022-47389/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart