CODESYS Improper Validation of Consistency within Input in multiple products
CVE-2023-37559

6.5MEDIUM

Key Information:

Vendor: Codesys
Status: Codesys Control For Beaglebone Sl; Codesys Control For Empc-a/imx6 Sl; Codesys Control For Iot2000 Sl; Codesys Control For Linux Sl
Vendor: CVE Published:; 3 August 2023

What is CVE-2023-37559?

After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37558

Affected Version(s)

CODESYS Control for BeagleBone SL 0

CODESYS Control for emPC-A/iMX6 SL 0

CODESYS Control for IOT2000 SL 0

References

https://cert.vde.com/en/advisories/VDE-2023-019/

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 3, 2023
Vulnerability Reserved
Jul 7, 2023

Credit

Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft