Multiple vulnerabilities in CODESYS products

Published: 2025-04-07

Risk	Medium
Patch available	NO
Number of vulnerabilities	2
CVE-ID	CVE-2022-4046 CVE-2023-28355
CWE-ID	CWE-119 CWE-354
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	CODESYS Control for BeagleBone SL Client/Desktop applications / Other client software CODESYS Control for emPC-A/iMX6 SL Client/Desktop applications / Other client software CODESYS Control for IOT2000 SL Client/Desktop applications / Other client software CODESYS Control for Linux SL Client/Desktop applications / Other client software CODESYS Control for PFC100 SL Client/Desktop applications / Other client software CODESYS Control for PFC200 SL Client/Desktop applications / Other client software CODESYS Control for PLCnext SL Client/Desktop applications / Other client software CODESYS Control for Raspberry Pi SL Client/Desktop applications / Other client software CODESYS Control for WAGO Touch Panels 600 SL Client/Desktop applications / Other client software CODESYS Control Runtime System Toolkit Client/Desktop applications / Other client software CODESYS Control RTE (for Beckhoff CX) SL Other software / Other software solutions CODESYS Control RTE (SL) Other software / Other software solutions CODESYS Control Win (SL) Other software / Other software solutions CODESYS HMI (SL) Other software / Other software solutions
Vendor	CODESYS

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU107056

Risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-4046

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote user can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

CODESYS Control for BeagleBone SL: All versions

CODESYS Control for emPC-A/iMX6 SL: All versions

CODESYS Control for IOT2000 SL: All versions

CODESYS Control for Linux SL: All versions

CODESYS Control for PFC100 SL: All versions

CODESYS Control for PFC200 SL: All versions

CODESYS Control for PLCnext SL: All versions

CODESYS Control for Raspberry Pi SL: All versions

CODESYS Control for WAGO Touch Panels 600 SL: All versions

CODESYS Control RTE (for Beckhoff CX) SL: All versions

CODESYS Control RTE (SL): All versions

CODESYS Control Runtime System Toolkit: All versions

CODESYS Control Win (SL): All versions

CODESYS HMI (SL): All versions

CPE2.3

External links

https://cert.vde.com/en/advisories/VDE-2023-025/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper validation of integrity check value

EUVDB-ID: #VU107057