CVE-2022-32136: Codesys Plcwinnt

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-of-service. User interaction is not required.

Affected products

• Codesys Plcwinnt: from 2.0, before 2.4.7.57 (fixed in 2.4.7.57)
• Codesys Runtime Toolkit: from 2.0, before 2.4.7.57 (fixed in 2.4.7.57)

Published 2022-06-24. Last modified 2026-06-17.