PT-2023-25687 · 3S Smart Software Solutions · Codesys Development System+1

Sina Kheirkhah + 1 · Published 2023-07-28 · Updated 2023-08-03 · CVE-2023-3670

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CODESYS Development System versions 3.5.9.0 through 3.5.17.0 CODESYS Scripting versions 4.0.0.0 through 4.1.0.0

Description The issue is related to unsafe directory permissions in the affected software. This could allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.

Recommendations For CODESYS Development System versions 3.5.9.0 through 3.5.17.0, consider restricting access to sensitive directories to prevent unauthorized script execution until a patch is available. For CODESYS Scripting versions 4.0.0.0 through 4.1.0.0, consider implementing additional security measures to monitor and control script execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2023-3670

ZDI-23-1016

Affected Products

Codesys Development System

Codesys Scripting

References · 5

• https://osv.dev/vulnerability/CVE-2023-3670 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3670 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-1016 · Security Note
• https://cert.vde.com/en/advisories/VDE-2023-024 · Note
• https://t.me/cibsecurity/67361 · Telegram Post