PT-2023-5013 · 3S Smart Software Solutions · Codesys

Vladimir Tokarev · Publicado 2023-08-03 · Atualizado 2023-08-08 · CVE-2023-37551

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Codesys products (affected versions not specified)

Description The issue allows specially crafted network communication requests to utilize the CmpApp component and download files with any file extensions to the controller after successful user authentication. Unlike the regular file download via CmpFileTransfer, this method does not filter certain file types, potentially compromising the integrity of the CODESYS control runtime system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Enumeração de Fraquezas

CWE-552

Identificadores relacionados

BDU:2023-05552

CVE-2023-37551

Produtos afetados

Codesys

Referências · 8

• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17765&token=04e117e1408fdb8e02b4bc821aa3be819668aef4&download= · Nota
• https://bdu.fstec.ru/vul/2023-05552 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-37551 · Aviso do Fabricante
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17765&token=04e117e1408fdb8e02b4bc821aa3be819668aef4&download= · Nota
• https://t.me/cibsecurity/67673 · Publicação no Telegram
• https://cert.vde.com/en/advisories/VDE-2023-019 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-37551 · Nota de Segurança
• https://t.me/cvenotify/56000 · Publicação no Telegram