PT-2023-4166 · 3S Smart Software Solutions · Codesys Development System

Sina Kheirkhah + 1 · Published 2023-08-03 · Updated 2024-10-02 · CVE-2023-3663

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CODESYS Development System versions 3.5.11.20 through 3.5.19.20

Description The issue is related to insufficient data authentication in the CODESYS Development System, which may allow a remote attacker to modify the content of notifications received via HTTP from the CODESYS notification server. This could potentially be exploited by an unauthenticated remote attacker.

Recommendations For versions 3.5.11.20 through 3.5.19.20, update to a version that includes the necessary integrity checks to prevent manipulation of notification content. As a temporary workaround, consider restricting access to the CODESYS notification server to minimize the risk of exploitation.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-940

CWE-345

Related Identifiers

BDU:2023-04478

CVE-2023-3663

ZDI-23-1105

Affected Products

Codesys Development System

References · 8

• https://osv.dev/vulnerability/CVE-2023-3663 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3663 · Security Note
• https://bdu.fstec.ru/vul/2023-04478 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-1105 · Security Note
• https://t.me/cvenotify/56001 · Telegram Post
• https://t.me/cibsecurity/67654 · Telegram Post
• https://cert.vde.com/en/advisories/VDE-2023-022 · Note
• https://t.me/cvenotify/55696 · Telegram Post