CVE-2022-47389

Deeper analysis

CVE-2022-47389 is a stack-based out-of-bounds write vulnerability (CWE-787) residing in the CmpTraceMgr component of multiple CODESYS products across various versions. The flaw permits an attacker to write data beyond the allocated stack buffer, which can corrupt adjacent memory regions and produce denial-of-service conditions, arbitrary memory overwrites, or remote code execution. It carries a CVSS 3.1 base score of 8.8 reflecting network attack vector, low attack complexity, and authenticated access requirements.

An authenticated remote attacker with valid credentials can send specially crafted requests over the network to the affected CmpTraceMgr component. Successful exploitation grants the ability to crash the service, corrupt process memory, or execute arbitrary code within the context of the vulnerable CODESYS runtime, potentially leading to full compromise of the industrial control system.

The vendor has published security advisories and associated patches through its customer portal that address the issue in supported product lines; operators are advised to apply the updates referenced in the CODESYS security notifications.

EPSS for the CVE reached a modest peak of 0.0575 before receding to the current value of 0.0388, indicating limited but non-zero post-disclosure exploitation interest.