← Back

CVE-2023-37557

nvd nist
Published: Aug 3, 2023Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: info@cert.vde.com (Secondary)

Description

After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition.

Affected (16)

Codesys
16 products
Control For Beaglebone Sl
Control For Empc A/imx6 Sl
Control For Iot2000 Sl
Control For Linux Sl
Control For Pfc100 Sl
Control For Pfc200 Sl
Control For Plcnext Sl
Control For Raspberry Pi Sl
Control For Wago Touch Panels 600 Sl
Control Rte Sl
Control Rte Sl (for Beckhoff Cx)
Control Runtime System Toolkit
Control Win Sl
Development System
Hmi
Safety Sil2
Configuration A
9 vulnerable
Vulnerable SoftwareAffected Versions
Control For Beaglebone Sl
Before 4.10.0.0
Control For Empc A/imx6 Sl
Before 4.10.0.0
Control For Iot2000 Sl
Before 4.10.0.0
Control For Linux Sl
Before 4.10.0.0
Control For Pfc100 Sl
Before 4.10.0.0
Control For Pfc200 Sl
Before 4.10.0.0
Control For Plcnext Sl
Before 4.10.0.0
Control For Raspberry Pi Sl
Before 4.10.0.0
Control For Wago Touch Panels 600 Sl
Before 4.10.0.0
Configuration B
7 vulnerable
Vulnerable SoftwareAffected Versions
Control Rte Sl
Before 3.5.19.20
Control Rte Sl (for Beckhoff Cx)
Before 3.5.19.20
Control Runtime System Toolkit
Before 3.5.19.20
Control Win Sl
Before 3.5.19.20
Development System
Before 3.5.19.20
Hmi
Before 3.5.19.20
Safety Sil2
Before 3.5.19.20

Related CWEs

CWE-787
Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.

References (2)

Source: info@cert.vde.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.