Vulnerability Description
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37553, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Codesys | Control For Beaglebone Sl | < 4.10.0.0 |
| Codesys | Control For Empc-A\/Imx6 Sl | < 4.10.0.0 |
| Codesys | Control For Iot2000 Sl | < 4.10.0.0 |
| Codesys | Control For Linux Sl | < 4.10.0.0 |
| Codesys | Control For Pfc100 Sl | < 4.10.0.0 |
| Codesys | Control For Pfc200 Sl | < 4.10.0.0 |
| Codesys | Control For Plcnext Sl | < 4.10.0.0 |
| Codesys | Control For Raspberry Pi Sl | < 4.10.0.0 |
| Codesys | Control For Wago Touch Panels 600 Sl | < 4.10.0.0 |
| Codesys | Control Rte Sl | < 3.5.19.20 |
| Codesys | Control Rte Sl \(For Beckhoff Cx\) | < 3.5.19.20 |
| Codesys | Control Runtime System Toolkit | < 3.5.19.20 |
| Codesys | Control Win Sl | < 3.5.19.20 |
| Codesys | Development System | < 3.5.19.20 |
| Codesys | Hmi | < 3.5.19.20 |
| Codesys | Safety Sil2 | < 3.5.19.20 |
Related Weaknesses (CWE)
References
- https://cert.vde.com/en/advisories/VDE-2023-019/Third Party Advisory
- https://cert.vde.com/en/advisories/VDE-2023-019/Third Party Advisory
FAQ
What is CVE-2023-37552?
CVE-2023-37552 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component...
How severe is CVE-2023-37552?
CVE-2023-37552 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-37552?
Check the references section above for vendor advisories and patch information. Affected products include: Codesys Control For Beaglebone Sl, Codesys Control For Empc-A\/Imx6 Sl, Codesys Control For Iot2000 Sl, Codesys Control For Linux Sl, Codesys Control For Pfc100 Sl.