Action not permitted
Modal body text goes here.
Modal Title
Modal Body
wid-sec-w-2024-0134
Vulnerability from csaf_certbund
Published
2024-01-16 23:00
Modified
2024-01-16 23:00
Summary
ABB AC-500: Mehrere Schwachstellen ermöglichen Denial of Service
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Die ABB AC-500 ist eine speicherprogrammierbare Steuerung (SPS).
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ABB AC-500 ausnutzen, um einen Denial of Service Angriff durchzuführen.
Betroffene Betriebssysteme
- BIOS/Firmware
{ document: { aggregate_severity: { text: "mittel", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "Die ABB AC-500 ist eine speicherprogrammierbare Steuerung (SPS).", title: "Produktbeschreibung", }, { category: "summary", text: "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ABB AC-500 ausnutzen, um einen Denial of Service Angriff durchzuführen.", title: "Angriff", }, { category: "general", text: "- BIOS/Firmware", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2024-0134 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0134.json", }, { category: "self", summary: "WID-SEC-2024-0134 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0134", }, { category: "external", summary: "ABB Cyber Security Advisory vom 2024-01-16", url: "https://search.abb.com/library/Download.aspx?Action=Launch&DocumentID=3ADR011264", }, ], source_lang: "en-US", title: "ABB AC-500: Mehrere Schwachstellen ermöglichen Denial of Service", tracking: { current_release_date: "2024-01-16T23:00:00.000+00:00", generator: { date: "2024-08-15T18:03:53.798+00:00", engine: { name: "BSI-WID", version: "1.3.5", }, }, id: "WID-SEC-W-2024-0134", initial_release_date: "2024-01-16T23:00:00.000+00:00", revision_history: [ { date: "2024-01-16T23:00:00.000+00:00", number: "1", summary: "Initiale Fassung", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { category: "product_name", name: "ABB AC-500 < v3_3.7.0", product: { name: "ABB AC-500 < v3_3.7.0", product_id: "T029732", product_identification_helper: { cpe: "cpe:/h:abb:ac-500:v3_3.7.0", }, }, }, ], category: "vendor", name: "ABB", }, ], }, vulnerabilities: [ { cve: "CVE-2023-37559", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2023-37559", }, { cve: "CVE-2023-37558", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2023-37558", }, { cve: "CVE-2023-37557", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2023-37557", }, { cve: "CVE-2023-37556", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2023-37556", }, { cve: "CVE-2023-37555", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2023-37555", }, { cve: "CVE-2023-37554", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2023-37554", }, { cve: "CVE-2023-37553", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2023-37553", }, { cve: "CVE-2023-37552", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2023-37552", }, { cve: "CVE-2023-37551", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2023-37551", }, { cve: "CVE-2023-37550", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2023-37550", }, { cve: "CVE-2023-37549", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2023-37549", }, { cve: "CVE-2023-37548", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2023-37548", }, { cve: "CVE-2023-37547", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2023-37547", }, { cve: "CVE-2023-37546", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2023-37546", }, { cve: "CVE-2023-37545", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2023-37545", }, { cve: "CVE-2022-47391", notes: [ { category: "description", text: "In ABB AC-500 existieren mehrere Schwachstellen. Diese sind unter anderem auf Fehler bei der Validierung von Daten und Eingaben, Out-of-Bounds-Schreibfehler sowie Fehler bei der Zugriffsbeschränkung zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen.", }, ], release_date: "2024-01-16T23:00:00.000+00:00", title: "CVE-2022-47391", }, ], }
cve-2023-37552
Vulnerability from cvelistv5
Published
2023-08-03 11:04
Modified
2024-10-11 18:10
Severity ?
EPSS score ?
Summary
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37553, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | CODESYS | CODESYS Control for BeagleBone SL |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:16:30.508Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-37552", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-11T18:04:09.376275Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-11T18:10:33.714Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft", }, ], datePublic: "2023-08-03T10:30:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37553, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.<br><br>", }, ], value: "In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37553, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.\n\n", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-03T11:04:04.128Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], source: { advisory: "VDE-2023-019", defect: [ "CERT@VDE#64558", ], discovery: "EXTERNAL", }, title: "CODESYS Improper Input Validation in CmpAppBP", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2023-37552", datePublished: "2023-08-03T11:04:04.128Z", dateReserved: "2023-07-07T07:39:16.323Z", dateUpdated: "2024-10-11T18:10:33.714Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-37545
Vulnerability from cvelistv5
Published
2023-08-03 10:59
Modified
2024-10-11 18:14
Severity ?
EPSS score ?
Summary
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37546, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549, CVE-2023-37550
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | CODESYS | CODESYS Control for BeagleBone SL |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:16:30.338Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert.vde.com/en/advisories/VDE-2023-019", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-37545", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-11T17:59:27.383050Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-11T18:14:47.934Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft", }, ], datePublic: "2023-08-03T10:30:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37546, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549, CVE-2023-37550<br><br>", }, ], value: "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37546, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549, CVE-2023-37550\n\n", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-03T10:59:28.961Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://cert.vde.com/en/advisories/VDE-2023-019", }, ], source: { advisory: "VDE-2023-019", defect: [ "CERT@VDE#64558", ], discovery: "EXTERNAL", }, title: "CODESYS: Improper Input Validation in CmpApp component", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2023-37545", datePublished: "2023-08-03T10:59:28.961Z", dateReserved: "2023-07-07T07:39:16.322Z", dateUpdated: "2024-10-11T18:14:47.934Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-37551
Vulnerability from cvelistv5
Published
2023-08-03 11:03
Modified
2024-10-11 18:10
Severity ?
EPSS score ?
Summary
In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | CODESYS | CODESYS Control for BeagleBone SL |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:16:30.609Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-37551", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-11T18:01:50.770279Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-11T18:10:51.431Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft", }, ], datePublic: "2023-08-03T10:30:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.", }, ], value: "In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-552", description: "CWE-552 Files or Directories Accessible to External Parties", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-03T11:03:37.457Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], source: { advisory: "VDE-2023-019", defect: [ "CERT@VDE#64558", ], discovery: "EXTERNAL", }, title: "CODESYS Files or Directories Accessible to External Parties in CmpApp", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2023-37551", datePublished: "2023-08-03T11:03:37.457Z", dateReserved: "2023-07-07T07:39:16.323Z", dateUpdated: "2024-10-11T18:10:51.431Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-37555
Vulnerability from cvelistv5
Published
2023-08-03 11:05
Modified
2024-10-09 20:52
Severity ?
EPSS score ?
Summary
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37556.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | CODESYS | CODESYS Control for BeagleBone SL |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:16:30.445Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-37555", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-09T20:49:10.954455Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-09T20:52:51.974Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft", }, ], descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37556.<br><br>", }, ], value: "In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37556.\n\n", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-03T11:05:33.660Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], source: { advisory: "VDE-2023-019", defect: [ "CERT@VDE#64558", ], discovery: "EXTERNAL", }, title: "CODESYS Improper Input Validation in CmpAppBP", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2023-37555", datePublished: "2023-08-03T11:05:33.660Z", dateReserved: "2023-07-07T07:39:19.120Z", dateUpdated: "2024-10-09T20:52:51.974Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-37559
Vulnerability from cvelistv5
Published
2023-08-03 11:06
Modified
2024-10-11 18:09
Severity ?
EPSS score ?
Summary
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37558
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | CODESYS | CODESYS Control for BeagleBone SL |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:16:30.700Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-37559", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-11T18:07:28.102576Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-11T18:09:05.823Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft", }, ], datePublic: "2023-08-03T10:30:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37558", }, ], value: "After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37558", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-03T11:06:56.079Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], source: { advisory: "VDE-2023-019", defect: [ "CERT@VDE#64558", ], discovery: "EXTERNAL", }, title: "CODESYS Improper Validation of Consistency within Input in multiple products", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2023-37559", datePublished: "2023-08-03T11:06:56.079Z", dateReserved: "2023-07-07T07:39:19.122Z", dateUpdated: "2024-10-11T18:09:05.823Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2022-47391
Vulnerability from cvelistv5
Published
2023-05-15 09:59
Modified
2025-01-23 19:19
Severity ?
EPSS score ?
Summary
In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service.
References
Impacted products
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T14:55:07.901Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17555&token=212fc7e39bdd260cab6d6ca84333d42f50bcb3da&download=", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2022-47391", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2025-01-23T19:18:44.576335Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2025-01-23T19:19:22.826Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", modules: [ "CmpDevice", ], product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", modules: [ "CmpDevice", ], product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", modules: [ "CmpDevice", ], product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", modules: [ "CmpDevice", ], product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", modules: [ "CmpDevice", ], product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", modules: [ "CmpDevice", ], product: "CODESYS Safety SIL2 PSP", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", modules: [ "CmpDevice", ], product: "CODESYS Edge Gateway for Windows", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", modules: [ "CmpDevice", ], product: "CODESYS Gateway", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", modules: [ "CmpDevice", ], product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", modules: [ "CmpDevice", ], product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.8.0.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.8.0.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.8.0.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.8.0.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.8.0.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.8.0.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.8.0.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.8.0.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.8.0.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Edge Gateway for Linux", vendor: "CODESYS", versions: [ { lessThan: "V4.8.0.0", status: "affected", version: "V0.0.0.0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Microsoft", }, ], descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service.", }, ], value: "In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-05-15T09:59:52.803Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17555&token=212fc7e39bdd260cab6d6ca84333d42f50bcb3da&download=", }, ], source: { discovery: "EXTERNAL", }, title: "CODESYS: Multiple products prone to Improper Input Validation", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2022-47391", datePublished: "2023-05-15T09:59:52.803Z", dateReserved: "2022-12-14T06:03:27.265Z", dateUpdated: "2025-01-23T19:19:22.826Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-37550
Vulnerability from cvelistv5
Published
2023-08-03 11:03
Modified
2024-10-11 18:11
Severity ?
EPSS score ?
Summary
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37549.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | CODESYS | CODESYS Control for BeagleBone SL |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:16:30.425Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert.vde.com/en/advisories/VDE-2023-019", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-37550", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-11T18:01:46.088420Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-11T18:11:18.756Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft", }, ], datePublic: "2023-08-03T10:30:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37549.<br><br>", }, ], value: "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37549.\n\n", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-03T11:03:09.222Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://cert.vde.com/en/advisories/VDE-2023-019", }, ], source: { advisory: "VDE-2023-019", defect: [ "CERT@VDE#64558", ], discovery: "EXTERNAL", }, title: "CODESYS: Improper Input Validation in CmpApp component", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2023-37550", datePublished: "2023-08-03T11:03:09.222Z", dateReserved: "2023-07-07T07:39:16.322Z", dateUpdated: "2024-10-11T18:11:18.756Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-37556
Vulnerability from cvelistv5
Published
2023-08-03 11:05
Modified
2024-10-09 20:52
Severity ?
EPSS score ?
Summary
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37555.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | CODESYS | CODESYS Control for BeagleBone SL |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:16:30.852Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-37556", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-09T20:49:03.697246Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-09T20:52:36.722Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft", }, ], datePublic: "2023-08-03T10:30:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37555.<br><br>", }, ], value: "In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37555.\n\n", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-03T11:05:52.986Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], source: { advisory: "VDE-2023-019", defect: [ "CERT@VDE#64558", ], discovery: "EXTERNAL", }, title: "CODESYS Improper Input Validation in CmpAppBP", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2023-37556", datePublished: "2023-08-03T11:05:52.986Z", dateReserved: "2023-07-07T07:39:19.120Z", dateUpdated: "2024-10-09T20:52:36.722Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-37548
Vulnerability from cvelistv5
Published
2023-08-03 11:02
Modified
2024-10-11 18:12
Severity ?
EPSS score ?
Summary
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37549 and CVE-2023-37550
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | CODESYS | CODESYS Control for BeagleBone SL |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:16:30.432Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert.vde.com/en/advisories/VDE-2023-019", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-37548", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-11T17:59:49.760916Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-11T18:12:26.294Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft", }, ], datePublic: "2023-08-03T10:30:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37549 and CVE-2023-37550<br><br>", }, ], value: "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37549 and CVE-2023-37550\n\n", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-03T11:02:02.224Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://cert.vde.com/en/advisories/VDE-2023-019", }, ], source: { advisory: "VDE-2023-019", defect: [ "CERT@VDE#64558", ], discovery: "EXTERNAL", }, title: "CODESYS: Improper Input Validation in CmpApp component", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2023-37548", datePublished: "2023-08-03T11:02:02.224Z", dateReserved: "2023-07-07T07:39:16.322Z", dateUpdated: "2024-10-11T18:12:26.294Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-37554
Vulnerability from cvelistv5
Published
2023-08-03 11:05
Modified
2024-10-11 18:09
Severity ?
EPSS score ?
Summary
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37555 and CVE-2023-37556.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | CODESYS | CODESYS Control for BeagleBone SL |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:16:30.422Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-37554", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-11T18:05:06.756495Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-11T18:09:34.979Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft", }, ], datePublic: "2023-08-03T10:30:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37555 and CVE-2023-37556.<br><br>", }, ], value: "In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37555 and CVE-2023-37556.\n\n", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-03T11:05:09.750Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], source: { advisory: "VDE-2023-019", defect: [ "CERT@VDE#64558", ], discovery: "EXTERNAL", }, title: "CODESYS Improper Input Validation in CmpAppBP", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2023-37554", datePublished: "2023-08-03T11:05:09.750Z", dateReserved: "2023-07-07T07:39:16.323Z", dateUpdated: "2024-10-11T18:09:34.979Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-37557
Vulnerability from cvelistv5
Published
2023-08-03 11:06
Modified
2024-10-09 20:52
Severity ?
EPSS score ?
Summary
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | CODESYS | CODESYS Control for BeagleBone SL |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:16:30.379Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-37557", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-09T20:48:56.664856Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-09T20:52:16.817Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft", }, ], datePublic: "2023-08-03T10:30:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition.", }, ], value: "After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "CWE-787 Out-of-bounds Write", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-03T11:06:17.884Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], source: { advisory: "VDE-2023-019", defect: [ "CERT@VDE#64558", ], discovery: "EXTERNAL", }, title: "CODESYS Heap-based Buffer Overflow in multiple products", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2023-37557", datePublished: "2023-08-03T11:06:17.884Z", dateReserved: "2023-07-07T07:39:19.121Z", dateUpdated: "2024-10-09T20:52:16.817Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-37547
Vulnerability from cvelistv5
Published
2023-08-03 11:01
Modified
2024-10-11 18:12
Severity ?
EPSS score ?
Summary
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | CODESYS | CODESYS Control for BeagleBone SL |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:16:30.418Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert.vde.com/en/advisories/VDE-2023-019", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-37547", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-11T17:59:39.095120Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-11T18:12:55.550Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft", }, ], descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550<br><br>", }, ], value: "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550\n\n", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-03T11:01:10.534Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://cert.vde.com/en/advisories/VDE-2023-019", }, ], source: { advisory: "VDE-2023-019", defect: [ "CERT@VDE#64558", ], discovery: "EXTERNAL", }, title: "CODESYS: Improper Input Validation in CmpApp component", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2023-37547", datePublished: "2023-08-03T11:01:10.534Z", dateReserved: "2023-07-07T07:39:16.322Z", dateUpdated: "2024-10-11T18:12:55.550Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-37553
Vulnerability from cvelistv5
Published
2023-08-03 11:04
Modified
2024-10-11 18:10
Severity ?
EPSS score ?
Summary
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | CODESYS | CODESYS Control for BeagleBone SL |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:16:30.602Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-37553", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-11T18:05:01.815292Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-11T18:10:16.403Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft", }, ], datePublic: "2023-08-03T10:30:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.<br><br>", }, ], value: "In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.\n\n", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-03T11:04:39.061Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], source: { advisory: "VDE-2023-019", defect: [ "CERT@VDE#64558", ], discovery: "EXTERNAL", }, title: "CODESYS Improper Input Validation in CmpAppBP", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2023-37553", datePublished: "2023-08-03T11:04:39.061Z", dateReserved: "2023-07-07T07:39:16.323Z", dateUpdated: "2024-10-11T18:10:16.403Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-37546
Vulnerability from cvelistv5
Published
2023-08-03 11:00
Modified
2024-10-11 18:14
Severity ?
EPSS score ?
Summary
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | CODESYS | CODESYS Control for BeagleBone SL |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:16:30.484Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert.vde.com/en/advisories/VDE-2023-019", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-37546", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-11T17:59:33.810402Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-11T18:14:28.818Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft", }, ], datePublic: "2023-08-03T10:30:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550<br><br>", }, ], value: "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550\n\n", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-03T11:00:33.624Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://cert.vde.com/en/advisories/VDE-2023-019", }, ], source: { advisory: "VDE-2023-019", defect: [ "CERT@VDE#64558", ], discovery: "EXTERNAL", }, title: "CODESYS: Improper Input Validation in CmpApp component", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2023-37546", datePublished: "2023-08-03T11:00:33.624Z", dateReserved: "2023-07-07T07:39:16.322Z", dateUpdated: "2024-10-11T18:14:28.818Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-37558
Vulnerability from cvelistv5
Published
2023-08-03 11:06
Modified
2024-10-11 18:09
Severity ?
EPSS score ?
Summary
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37559
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | CODESYS | CODESYS Control for BeagleBone SL |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:16:30.767Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-37558", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-11T18:07:13.616622Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-11T18:09:20.780Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft", }, ], datePublic: "2023-08-03T10:30:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37559", }, ], value: "After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37559", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-03T11:06:36.112Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://cert.vde.com/en/advisories/VDE-2023-019/", }, ], source: { advisory: "VDE-2023-019", defect: [ "CERT@VDE#64558", ], discovery: "EXTERNAL", }, title: "CODESYS Improper Validation of Consistency within Input in multiple products", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2023-37558", datePublished: "2023-08-03T11:06:36.112Z", dateReserved: "2023-07-07T07:39:19.121Z", dateUpdated: "2024-10-11T18:09:20.780Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-37549
Vulnerability from cvelistv5
Published
2023-08-03 11:02
Modified
2024-10-11 18:12
Severity ?
EPSS score ?
Summary
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37550
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | CODESYS | CODESYS Control for BeagleBone SL |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T17:16:30.241Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert.vde.com/en/advisories/VDE-2023-019", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2023-37549", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-10-11T18:01:40.613696Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-11T18:12:01.720Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CODESYS Control for BeagleBone SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for emPC-A/iMX6 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for IOT2000 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Linux SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC100 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PFC200 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for PLCnext SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for Raspberry Pi SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control for WAGO Touch Panels 600 SL", vendor: "CODESYS", versions: [ { lessThan: "V4.10.0.0", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (for Beckhoff CX) SL", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control RTE (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Runtime System Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Control Win (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Development System V3", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS HMI (SL)", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, { defaultStatus: "unaffected", product: "CODESYS Safety SIL2 Runtime Toolkit", vendor: "CODESYS", versions: [ { lessThan: "V3.5.19.20", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft", }, ], datePublic: "2023-08-03T10:30:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37550<br><br>", }, ], value: "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37550\n\n", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-03T11:02:33.725Z", orgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", shortName: "CERTVDE", }, references: [ { url: "https://cert.vde.com/en/advisories/VDE-2023-019", }, ], source: { advisory: "VDE-2023-019", defect: [ "CERT@VDE#64558", ], discovery: "EXTERNAL", }, title: "CODESYS: Improper Input Validation in CmpApp component", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "270ccfa6-a436-4e77-922e-914ec3a9685c", assignerShortName: "CERTVDE", cveId: "CVE-2023-37549", datePublished: "2023-08-03T11:02:33.725Z", dateReserved: "2023-07-07T07:39:16.322Z", dateUpdated: "2024-10-11T18:12:01.720Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.