CVE-2022-47388
Published: 15 May 2023
Summary
CVE-2022-47388 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Codesys Control For Beaglebone Sl. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 15.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-47388 is a stack-based out-of-bounds write vulnerability (CWE-787) in the CmpTraceMgr component affecting multiple versions of several CODESYS industrial automation products. The flaw carries a CVSS 3.1 score of 8.8 and permits an authenticated remote attacker to write attacker-controlled data onto the stack, resulting in denial of service, memory corruption, or remote code execution.
An attacker with valid low-privileged network credentials can trigger the flaw over the network without user interaction, achieving full compromise of the affected controller or runtime environment. The vulnerability therefore allows remote takeover of industrial control systems that expose the CmpTraceMgr service.
Official CODESYS security advisories hosted at the referenced customer portal URLs describe available patches and mitigation steps for supported product lines. The associated EPSS score rose from low values to a peak of 0.0575 before receding to the current 0.0203, indicating a measurable but temporary increase in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-50155
Vulnerability details
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote…
more
code execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.