← Back

CVE-2023-6357

nvd nist
Published: Dec 5, 2023Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: info@cert.vde.com (Secondary)

Description

A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the device.

Affected (11)

Codesys
11 products
Control For Beaglebone Sl
Control For Empc A/imx6
Control For Iot2000 Sl
Control For Linux Arm Sl
Control For Linux Sl
Control For Pfc100 Sl
Control For Pfc200 Sl
Control For Plcnext Sl
Control For Raspberry Pi Sl
Control For Wago Touch Panels 600 Sl
Runtime Toolkit
Configuration A
11 vulnerable
Vulnerable SoftwareAffected Versions
Control For Beaglebone Sl
Before 4.11.0.0
Control For Empc A/imx6
Before 4.11.0.0
Control For Iot2000 Sl
Before 4.11.0.0
Control For Linux Arm Sl
Before 4.11.0.0
Control For Linux Sl
Before 4.11.0.0
Control For Pfc100 Sl
Before 4.11.0.0
Control For Pfc200 Sl
Before 4.11.0.0
Control For Plcnext Sl
Before 4.11.0.0
Control For Raspberry Pi Sl
Before 4.11.0.0
Control For Wago Touch Panels 600 Sl
Before 4.11.0.0
Runtime Toolkit
Before 3.5.19.50

Related CWEs

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (3)

Source: info@cert.vde.com
Broken Link
Source: nvd@nist.gov
MitigationThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link

Timeline

No history available yet.