DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
CODESYS: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2024-04-21
Ein Angreifer kann mehrere Schwachstellen in CODESYS ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder einen Brute-Force-Angriff durchzuführen.
01
beschreibt (25)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-6357US | — | — | ||
A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the d… | ||||
| CVE-2023-3935US | — | — | ||
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of… | ||||
| CVE-2022-4046US | — | — | ||
In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access… | ||||
| CVE-2023-3669US | —OT erhöht | — | ||
A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialo… | ||||
| CVE-2023-37559US | — | — | ||
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the… | ||||
| CVE-2023-37558US | — | — | ||
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the… | ||||
| CVE-2023-37557US | — | — | ||
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to over… | ||||
| CVE-2023-37556US | — | — | ||
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37555US | — | — | ||
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37554US | — | — | ||
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37553US | — | — | ||
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37552US | medium6.5 | — | ||
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37551US | medium6.5 | — | ||
In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to d… | ||||
| CVE-2023-37550US | — | — | ||
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37549US | — | — | ||
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37548US | — | — | ||
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37547US | — | — | ||
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37546US | — | — | ||
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-3663US | —OT erhöht | — | ||
In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of not… | ||||
| CVE-2023-3662US | — | — | ||
In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context… | ||||
20 von 25 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- CODESYS Advisory vom 2023-06-27external
- CODESYS Advisory vom 2023-04-03external
- CODESYS Advisory vom 2023-03-08external
- CODESYS Advisory vom 2023-10-31external
- CODESYS Advisory vom 2023-08-03external
- CODESYS Advisory vom 2023-10-31external
- CODESYS Advisory vom 2023-08-03external
- CODESYS Advisory vom 2023-07-26external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan