CVE-2022-22517: Codesys Control For Beaglebone Sl

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed.

Affected products

• Codesys Control For Beaglebone Sl: before 4.5.0.0 (fixed in 4.5.0.0)
• Codesys Control For Beckhoff CX9020: before 4.5.0.0 (fixed in 4.5.0.0)
• Codesys Control For Empc-a/imx6 Sl: before 4.5.0.0 (fixed in 4.5.0.0)
• Codesys Control For IOT2000 Sl: before 4.5.0.0 (fixed in 4.5.0.0)
• Codesys Control For Linux Sl: before 4.5.0.0 (fixed in 4.5.0.0)
• Codesys Control For PFC100 Sl: before 4.5.0.0 (fixed in 4.5.0.0)
• Codesys Control For PFC200 Sl: before 4.5.0.0 (fixed in 4.5.0.0)
• Codesys Control For Plcnext Sl: before 4.5.0.0 (fixed in 4.5.0.0)
• Codesys Control For Raspberry Pi Sl: before 4.5.0.0 (fixed in 4.5.0.0)
• Codesys Control For Wago Touch Panels 600 Sl: before 4.5.0.0 (fixed in 4.5.0.0)
• Codesys Control Rte Sl: before 3.5.18.0 (fixed in 3.5.18.0)
• Codesys Control Rte Sl (for Beckhoff Cx): before 3.5.18.0 (fixed in 3.5.18.0)
• Codesys Control Runtime System Toolkit: before 3.5.18.0 (fixed in 3.5.18.0)
• Codesys Control Win Sl: before 3.5.18.0 (fixed in 3.5.18.0)
• Codesys Development System: from 3.0, before 3.5.18.0 (fixed in 3.5.18.0)
• Codesys Edge Gateway: before 3.5.18.0 (fixed in 3.5.18.0); before 4.5.0.0 (fixed in 4.5.0.0)
• Codesys Embedded Target Visu Toolkit: before 3.5.18.0 (fixed in 3.5.18.0)
• Codesys Gateway: before 3.5.18.0 (fixed in 3.5.18.0)
• Codesys HMI Sl: before 3.5.18.0 (fixed in 3.5.18.0)
• Codesys Remote Target Visu Toolkit: before 3.5.18.0 (fixed in 3.5.18.0)

Published 2022-04-07. Last modified 2026-06-17.