CVE-2023-37548: CODESYS: Improper Input Validation in CmpApp component
First published: Thu Aug 03 2023(Updated: )
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37549 and CVE-2023-37550
Credit: info@cert.vde.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CODESYS Control Beaglebone SL | <4.10.0.0 | |
| CODESYS Control for empc-a/imx6 | <4.10.0.0 | |
| CODESYS Control for IoT2000 | <4.10.0.0 | |
| CODESYS Control for Linux | <4.10.0.0 | |
| CODESYS Control PFC100 SL | <4.10.0.0 | |
| WAGO PFC200 | <4.10.0.0 | |
| CODESYS Control for PLCnext | <4.10.0.0 | |
| CODESYS Control Raspberry Pi SL | <4.10.0.0 | |
| CODESYS Control for WAGO Touch Panels 600 | <4.10.0.0 | |
| CODESYS Control RTE | <3.5.19.20 | |
| CODESYS Control RTE SL (for Beckhoff CX) | <3.5.19.20 | |
| CODESYS Runtime System Toolkit | <3.5.19.20 | |
| CODESYS Control Win SL | <3.5.19.20 | |
| CODESYS Development System | <3.5.19.20 | |
| CODESYS HMI (SL) | <3.5.19.20 | |
| CODESYS Safety SIL2 Runtime Toolkit | <3.5.19.20 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-37548.
What is the severity of CVE-2023-37548?
The severity of CVE-2023-37548 is medium, with a CVSS score of 6.5.
Which products are affected by CVE-2023-37548?
Multiple Codesys products in multiple versions are affected by CVE-2023-37548.
How can CVE-2023-37548 be exploited?
CVE-2023-37548 can be exploited by sending specific crafted network communication requests with inconsistent content.
How can CVE-2023-37548 be fixed?
To fix CVE-2023-37548, it is recommended to update to a version higher than 4.10.0.0 for the affected Codesys products.
- collector/nvd-latest
- agent/type
- agent/weakness
- agent/severity
- agent/title
- agent/references
- agent/first-publish-date
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/author
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/codesys
- canonical/codesys control beaglebone sl
- canonical/codesys control for empc-a/imx6
- canonical/codesys control for iot2000
- canonical/codesys control for linux
- canonical/codesys control pfc100 sl
- canonical/wago pfc200
- canonical/codesys control for plcnext
- canonical/codesys control raspberry pi sl
- canonical/codesys control for wago touch panels 600
- canonical/codesys control rte
- canonical/codesys control rte sl (for beckhoff cx)
- canonical/codesys runtime system toolkit
- canonical/codesys control win sl
- canonical/codesys development system
- canonical/codesys hmi (sl)
- canonical/codesys safety sil2 runtime toolkit