CVE-2023-37545: CODESYS: Improper Input Validation in CmpApp component
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37546, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549, CVE-2023-37550
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-37545?
CVE-2023-37545 is a vulnerability in multiple Codesys products that can cause a denial-of-service condition.
Which Codesys products are affected by CVE-2023-37545?
Multiple Codesys products, including Control For Beaglebone Sl, Control For Empc-a/imx6 Sl, Control For Iot2000 Sl, Control For Linux Sl, Control For Pfc100 Sl, Control For Pfc200 Sl, Control For Plcnext Sl, Control For Raspberry Pi Sl, Control For Wago Touch Panels 600 Sl, Control Rte Sl, Control Rte Sl (for Beckhoff Cx), Control Runtime System Toolkit, Control Win Sl, CODESYS Development System, Codesys Hmi, and Codesys Safety Sil2, are affected by CVE-2023-37545.
What is the severity of CVE-2023-37545?
CVE-2023-37545 has a severity rating of 6.5 (medium severity).
How does CVE-2023-37545 work?
CVE-2023-37545 is caused by specific crafted network communication requests with inconsistent content that can cause the CmpApp component to read internally from an invalid address, leading to a denial-of-service condition.
Is there a fix for CVE-2023-37545?
At the moment, there is no known fix for CVE-2023-37545. It is recommended to follow the recommendations provided by the vendor.