Log in Start free

Vulnerability · Published Aug 3, 2023 · Assigned by CERTVDE

CVE-2023-37548CODESYS: Improper Input Validation in CmpApp component

Medium 6.5

In plain English

A medium-severity improper input validation in CODESYS Control for BeagleBone SL from CODESYS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 49.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37549 and CVE-2023-37550

Affected products (as reported)

VendorProductVersions
CODESYS CODESYS Control for BeagleBone SL 0 – before V4.10.0.0
CODESYS CODESYS Control for emPC-A/iMX6 SL 0 – before V4.10.0.0
CODESYS CODESYS Control for IOT2000 SL 0 – before V4.10.0.0
CODESYS CODESYS Control for Linux SL 0 – before V4.10.0.0
CODESYS CODESYS Control for PFC100 SL 0 – before V4.10.0.0
CODESYS CODESYS Control for PFC200 SL 0 – before V4.10.0.0
CODESYS CODESYS Control for PLCnext SL 0 – before V4.10.0.0
CODESYS CODESYS Control for Raspberry Pi SL 0 – before V4.10.0.0
CODESYS CODESYS Control for WAGO Touch Panels 600 SL 0 – before V4.10.0.0
CODESYS CODESYS Control RTE (for Beckhoff CX) SL 0 – before V3.5.19.20
CODESYS CODESYS Control RTE (SL) 0 – before V3.5.19.20
CODESYS CODESYS Control Runtime System Toolkit 0 – before V3.5.19.20
CODESYS CODESYS Control Win (SL) 0 – before V3.5.19.20
CODESYS CODESYS Development System V3 0 – before V3.5.19.20
CODESYS CODESYS HMI (SL) 0 – before V3.5.19.20
CODESYS CODESYS Safety SIL2 Runtime Toolkit 0 – before V3.5.19.20

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References