PT-2023-5007 · 3S Smart Software Solutions · Codesys

Vladimir Tokarev · Published 2023-08-03 · Updated 2023-08-08 · CVE-2023-37557

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions CODESYS versions (affected versions not specified)

Description The issue is related to a buffer overflow in the memory of the CMPappBP component of CODESYS products. This can be exploited by a remote attacker to cause a denial-of-service condition. The exploitation requires successful authentication as a user in the affected CODESYS products. Specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, leading to the denial-of-service condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2023-05546

CVE-2023-37557

Affected Products

Codesys

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-37557 · Security Note
• https://bdu.fstec.ru/vul/2023-05546 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37557 · Vendor Advisory
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17765&token=04e117e1408fdb8e02b4bc821aa3be819668aef4&download= · Note
• https://cert.vde.com/en/advisories/VDE-2023-019 · Note
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17765&token=04e117e1408fdb8e02b4bc821aa3be819668aef4&download= · Note
• https://t.me/cibsecurity/67664 · Telegram Post