PT-2023-3473 · 3S Smart Software Solutions+1 · Codesys+1
Published
2023-04-03
·
Updated
2023-05-22
·
CVE-2022-47385
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
CODESYS products (affected versions not specified)
Schneider Electric products (affected versions not specified)
Description
The issue is related to a stack-based out-of-bounds write vulnerability in the CmpAppForce Component. This vulnerability can be exploited by an authenticated, remote attacker to write data into the stack, potentially leading to a denial-of-service condition, memory overwriting, or remote code execution.
Recommendations
For CODESYS products, consider disabling the CmpAppForce Component as a temporary workaround until a patch is available.
For Schneider Electric products, restrict access to the CmpAppForce Component to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Codesys
Schneider Electric