CVE-2022-47386

Deeper analysis

CVE-2022-47386 is a stack-based out-of-bounds write vulnerability, tracked under CWE-787, that affects the CmpTraceMgr component in multiple versions of several CODESYS products. The flaw permits an attacker to write data beyond the bounds of a stack buffer, which can corrupt adjacent memory regions and produce denial-of-service conditions, arbitrary memory overwrites, or remote code execution. The issue carries a CVSS 3.1 base score of 8.8.

An authenticated remote attacker with network access can trigger the flaw without user interaction. Successful exploitation grants the ability to crash the affected component, corrupt process memory, or execute arbitrary code with the privileges of the CODESYS runtime, potentially leading to full compromise of the industrial control system.

Vendor advisories and security updates addressing the vulnerability are available from CODESYS at the referenced customer portal links, which include patch information and recommended remediation steps for affected product versions.

EPSS for the CVE rose from a low baseline to a recorded peak of 0.0575 on 2026-03-11 before receding to the current value of 0.0203, indicating a period of increased exploitation interest after public disclosure.