CVE-2023-37552
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37553, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.
- Score
- CVSS 3.1 6.5 Medium
- Status
- Modified - info@cert.vde.com
- Published
- 2023-08-03
- Last modified
- 2024-10-11
- Weaknesses
- CWE-20
Affected products
- Codesys Control For Beaglebone Sl (Codesys)
- Codesys Control For Empc-aimx6 Sl (Codesys)
- Codesys Control For Iot2000 Sl (Codesys)
- Codesys Control For Linux Sl (Codesys)
- Codesys Control For Pfc100 Sl (Codesys)
- Codesys Control For Pfc200 Sl (Codesys)
- Codesys Control For Plcnext Sl (Codesys)
- Codesys Control For Raspberry Pi Sl (Codesys)
- Codesys Control For Wago Touch Panels 600 Sl (Codesys)
- Codesys Control Rte For Beckhoff Cx Sl (Codesys)
- Codesys Control Rte Sl (Codesys)
- Codesys Control Runtime System Toolkit (Codesys)
- Codesys Control Win Sl (Codesys)
- Codesys Development System V3 (Codesys)
- Codesys Hmi Sl (Codesys)
- Codesys Safety Sil2 Runtime Toolkit (Codesys)
- Control For Beaglebone Sl (Codesys)
- Control For Empc-a/imx6 Sl (Codesys)
- Control For Iot2000 Sl (Codesys)
- Control For Linux Sl (Codesys)
- Control For Pfc100 Sl (Codesys)
- Control For Pfc200 Sl (Codesys)
- Control For Plcnext Sl (Codesys)
- Control For Raspberry Pi Sl (Codesys)
- Control For Wago Touch Panels 600 Sl (Codesys)
- Control Rte Sl (Codesys)
- Control Rte Sl (for Beckhoff Cx) (Codesys)
- Control Runtime System Toolkit (Codesys)
- Control Win Sl (Codesys)
- Development System (Codesys)
- Hmi (Codesys)
- Safety Sil2 (Codesys)
References
- https://cert.vde.com/en/advisories/VDE-2023-019/
