CVE-2023-6357: OS Command Injection in multiple CODESYS products
Published Dec 5, 2023
·Updated
A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the device.
Affected Software
11 affected components
CODESYS Control For Beaglebone Sl<4.11.0.0
CODESYS Control For Empc-a\/imx6<4.11.0.0
CODESYS Control For Iot2000 Sl<4.11.0.0
CODESYS Control For Linux Arm Sl<4.11.0.0
CODESYS Control For Linux Sl<4.11.0.0
CODESYS Control For Pfc100 Sl<4.11.0.0
CODESYS Control For Pfc200 Sl<4.11.0.0
CODESYS Control For Plcnext Sl<4.11.0.0
CODESYS Control For Raspberry Pi Sl<4.11.0.0
CODESYS Control For Wago Touch Panels 600 Sl<4.11.0.0
CODESYS Runtime Toolkit<3.5.19.50
Event History
Dec 5, 2023
CVE Published
02:29 PM
Data Sourced
02:29 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-6357?
CVE-2023-6357 is classified as a low-severity vulnerability.
2
How do I fix CVE-2023-6357?
To fix CVE-2023-6357, update to a version of CODESYS Control that is above 4.11.0.0 or 3.5.19.50.
3
What are the affected software versions for CVE-2023-6357?
CVE-2023-6357 affects CODESYS Control versions up to 4.11.0.0 and CoDeSys Runtime Toolkit versions up to 3.5.19.50.
4
Can CVE-2023-6357 be exploited remotely?
Yes, CVE-2023-6357 can be exploited remotely by a low-privileged attacker.
5
What could an attacker gain by exploiting CVE-2023-6357?
Exploiting CVE-2023-6357 could allow an attacker to execute additional system commands, potentially gaining full control of the device.