CVE-2022-31802: Codesys Gateway

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gateway password.

Affected products

• Codesys Gateway: from 2.0, before 2.3.9.38 (fixed in 2.3.9.38)

Published 2022-06-24. Last modified 2026-06-17.