What is CVE-2022-1794?

CVE-2022-1794 is a medium-severity vulnerability in Codesys Opc Da Server, classified under Plaintext Storage of a Password. CVSS score: 5.5/10. Published 2022-07-11.

How severe is CVE-2022-1794?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Codesys Opc Da Server

CVE-2022-1794

The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authorized Microsoft Windows users of the system.

EPSS: 0.002 (11.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Codesys Opc Da Server — versions V3
Codesys Opc_da_server
Microsoft Windows

Weakness classification (CWE)

CWE-256 — Plaintext Storage of a Password
CWE-522 — Insufficiently Protected Credentials

References

info@cert.vde.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2022-1794?: CVE-2022-1794 is a medium-severity vulnerability in Codesys Opc Da Server, classified under Plaintext Storage of a Password. CVSS score: 5.5/10. Published 2022-07-11.
How severe is CVE-2022-1794?: Medium severity. CVSS v3 base score is 5.5 out of 10.