#VU107057 Improper validation of integrity check value in CODESYS products - CVE-2023-28355

Vulnerability identifier: #VU107057

Vulnerability risk: Medium

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:U/U:Green

CVE-ID: CVE-2023-28355

CWE-ID: CWE-354

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
CODESYS Control for BeagleBone SL
CODESYS Control for emPC-A/iMX6 SL
CODESYS Control for IOT2000 SL
CODESYS Control for Linux SL
CODESYS Control for PFC100 SL
CODESYS Control for PFC200 SL
CODESYS Control for PLCnext SL
CODESYS Control for Raspberry Pi SL
CODESYS Control for WAGO Touch Panels 600 SL
CODESYS Control Runtime System Toolkit
CODESYS Control RTE (for Beckhoff CX) SL
CODESYS Control RTE (SL)
CODESYS Control Win (SL)
CODESYS HMI (SL)

Software vendor:
CODESYS

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper validation of integrity check value. A remote user can modify files on the target system.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

• https://cert.vde.com/en/advisories/VDE-2023-025/