CODESYS: Improper Input Validation in CmpApp component
CVE-2023-37548

6.5MEDIUM

Key Information:

Vendor

Codesys

Status
Codesys Control For Beaglebone Sl
Codesys Control For Empc-a/imx6 Sl
Codesys Control For Iot2000 Sl
Codesys Control For Linux Sl
Vendor
CVE Published:
3 August 2023

What is CVE-2023-37548?

In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37549 and CVE-2023-37550

Affected Version(s)

CODESYS Control for BeagleBone SL 0

CODESYS Control for emPC-A/iMX6 SL 0

CODESYS Control for IOT2000 SL 0

References

https://cert.vde.com/en/advisories/VDE-2023-019

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft
.