Vulnerability · Published Dec 5, 2023 · Assigned by CERTVDE
CVE-2023-6357OS Command Injection in multiple CODESYS products
High 8.8
In plain English
A high-severity OS command injection in CODESYS Control for BeagleBone SL from CODESYS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.0%top 38.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CODESYS | CODESYS Control for BeagleBone SL | 0 – before 4.11.0.0 |
| CODESYS | CODESYS Control for emPC-A/iMX6 SL | 0 – before 4.11.0.0 |
| CODESYS | CODESYS Control for IOT2000 SL | 0 – before 4.11.0.0 |
| CODESYS | CODESYS Control for Linux ARM SL | 0 – before 4.11.0.0 |
| CODESYS | CODESYS Control for Linux SL | 0 – before 4.11.0.0 |
| CODESYS | CODESYS Control for PFC100 SL | 0 – before 4.11.0.0 |
| CODESYS | CODESYS Control for PFC200 SL | 0 – before 4.11.0.0 |
| CODESYS | CODESYS Control for PLCnext SL | 0 – before 4.11.0.0 |
| CODESYS | CODESYS Control for Raspberry Pi SL | 0 – before 4.11.0.0 |
| CODESYS | CODESYS Control for WAGO Touch Panels 600 SL | 0 – before 4.11.0.0 |
| CODESYS | CODESYS Runtime Toolkit for Linux or QNX | 0 – before 3.5.19.50 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H