CVE-2023-37551
Assigner: CERTVDE
Published: 2023-08-03T11:03:37.457Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: CODESYS Control for BeagleBone SL
vendor: CODESYS
versions: lessThan: V4.10.0.0
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CODESYS Control for emPC-A/iMX6 SL
vendor: CODESYS
versions: lessThan: V4.10.0.0
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CODESYS Control for IOT2000 SL
vendor: CODESYS
versions: lessThan: V4.10.0.0
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CODESYS Control for Linux SL
vendor: CODESYS
versions: lessThan: V4.10.0.0
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CODESYS Control for PFC100 SL
vendor: CODESYS
versions: lessThan: V4.10.0.0
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CODESYS Control for PFC200 SL
vendor: CODESYS
versions: lessThan: V4.10.0.0
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CODESYS Control for PLCnext SL
vendor: CODESYS
versions: lessThan: V4.10.0.0
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CODESYS Control for Raspberry Pi SL
vendor: CODESYS
versions: lessThan: V4.10.0.0
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CODESYS Control for WAGO Touch Panels 600 SL
vendor: CODESYS
versions: lessThan: V4.10.0.0
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CODESYS Control RTE (for Beckhoff CX) SL
vendor: CODESYS
versions: lessThan: V3.5.19.20
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CODESYS Control RTE (SL)
vendor: CODESYS
versions: lessThan: V3.5.19.20
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CODESYS Control Runtime System Toolkit
vendor: CODESYS
versions: lessThan: V3.5.19.20
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CODESYS Control Win (SL)
vendor: CODESYS
versions: lessThan: V3.5.19.20
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CODESYS Development System V3
vendor: CODESYS
versions: lessThan: V3.5.19.20
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CODESYS HMI (SL)
vendor: CODESYS
versions: lessThan: V3.5.19.20
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: CODESYS Safety SIL2 Runtime Toolkit
vendor: CODESYS
versions: lessThan: V3.5.19.20
status: affected
version: 0
versionType: semver
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft
datePublic: 2023-08-03T10:30:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.
value: In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
type: CWE
source: advisory: VDE-2023-019
defect: CERT@VDE#64558
discovery: EXTERNAL
title: CODESYS Files or Directories Accessible to External Parties in CmpApp
x_generator: engine: Vulnogram 0.1.0-dev