CODESYS Improper Input Validation in CmpAppBP
CVE-2023-37553

6.5MEDIUM

Key Information:

Vendor: Codesys
Status: Codesys Control For Beaglebone Sl; Codesys Control For Empc-a/imx6 Sl; Codesys Control For Iot2000 Sl; Codesys Control For Linux Sl
Vendor: CVE Published:; 3 August 2023

What is CVE-2023-37553?

In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.

Affected Version(s)

CODESYS Control for BeagleBone SL 0

CODESYS Control for emPC-A/iMX6 SL 0

CODESYS Control for IOT2000 SL 0

References

https://cert.vde.com/en/advisories/VDE-2023-019/

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 3, 2023
Vulnerability Reserved
Jul 7, 2023

Credit

Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft