Vulnerability · Published Aug 3, 2023 · Assigned by CERTVDE
CVE-2023-3663CODESYS: Missing integrity check in CODESYS Development System
High 8.8
In plain English
A high-severity security flaw in CODESYS Development System from CODESYS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.0%top 36.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CODESYS | CODESYS Development System | 3.5.11.20 – before 3.5.19.20 |
Weakness: CWE-940 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H