SB2025040730 - Multiple vulnerabilities in CODESYS products
Published: April 7, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 secuirty vulnerabilities.
1) Files or Directories Accessible to External Parties (CVE-ID: CVE-2023-37551)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the files or directories accessible to external parties in the CmpApp component. A remote user can load arbitrary files onto the controller and compromise the integrity of the CODESYS control runtime system.
2) Input validation error (CVE-ID: CVE-2023-37545)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the CmpApp component. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
3) Input validation error (CVE-ID: CVE-2023-37546)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the CmpApp component. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
4) Input validation error (CVE-ID: CVE-2023-37547)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the CmpApp component. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
5) Input validation error (CVE-ID: CVE-2023-37548)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the CmpApp component. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
6) Input validation error (CVE-ID: CVE-2023-37549)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the CmpApp component. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
7) Input validation error (CVE-ID: CVE-2023-37550)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the CmpApp component. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
8) Input validation error (CVE-ID: CVE-2023-37552)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the CmpAppBP component. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
9) Input validation error (CVE-ID: CVE-2023-37553)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the CmpAppBP component. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
10) Input validation error (CVE-ID: CVE-2023-37554)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the CmpAppBP component. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
11) Input validation error (CVE-ID: CVE-2023-37555)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the CmpAppBP component. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
12) Input validation error (CVE-ID: CVE-2023-37556)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the CmpAppBP component. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
13) Out-of-bounds write (CVE-ID: CVE-2023-37557)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input in the CmpAppBP component. A remote user can trigger an out-of-bounds write and perform a denial of service (DoS) attack.
14) Input validation error (CVE-ID: CVE-2023-37558)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the CmpAppForce component. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
15) Input validation error (CVE-ID: CVE-2023-37559)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the CmpAppForce component. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.