PT-2024-6449 · 3S Smart Software Solutions · Codesys Control

Villu164 · Published 2024-09-24 · Updated 2024-09-26 · CVE-2024-8175

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions CODESYS Control (affected versions not specified)

Description The issue is related to insufficient checking of unusual or exceptional states in the CODESYS web server, which can be exploited by a remote attacker to cause a denial of service (DoS) by sending a specially crafted TLS packet. This can lead to the web server accessing invalid memory, resulting in a DoS.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BDU:2024-07535

CVE-2024-8175

Affected Products

Codesys Control

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-8175 · Security Note
• https://bdu.fstec.ru/vul/2024-07535 · Security Note
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=18604&token=d5e1e2820ee63077b875b3bb41014b1f102e88a3&download= · Vendor Advisory
• https://cert.vde.com/en/advisories/VDE-2024-057 · Note
• https://twitter.com/CVEnew/status/1838862406467870924 · Twitter Post
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=18604&token=d5e1e2820ee63077b875b3bb41014b1f102e88a3&download= · Note
• https://t.me/latest_high_impact_cve/1211 · Telegram Post
• https://t.me/cvenotify/95914 · Telegram Post
• https://t.me/cvedetector/6301 · Telegram Post