CVE-2022-1965: Codesys Plcwinnt

High severity, CVSS 8.1. EPSS: 1.1% chance of exploitation in the next 30 days.

Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required.

Affected products

• Codesys Plcwinnt: from 2.0, before 2.4.7.57 (fixed in 2.4.7.57)
• Codesys Runtime Toolkit: from 2.0, before 2.4.7.57 (fixed in 2.4.7.57)

Published 2022-06-24. Last modified 2026-06-17.