CVE-2023-6357

highpriority · track · 0EPSS 0.010 · 61 %ileCHDEEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.96% (61st) EPSS
CVSS 8.8 · high
Is it mine?
103 products
Check your exposure
Who says so?
8 sources
cnnvd · enisa_euvd · abb_psirt · cert_bund

EPSS · scored 2026-10-22

A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the device.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedAC500 V3abb_psirt

    The problem is corrected in AC500 V3 firmware version 3.8.0. ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and available from Automation Builder 2.8.0.

  • Fixedcodesys_psirt

    Update the following products to version 3.5.19.50: • CODESYS Runtime Toolkit Update the following products to version 4.11.0.0.  • CODESYS Control for BeagleBone SL • CODESYS Control for emPC-A/iMX6 SL • CODESYS Control for IOT2000 SL • CODESYS Control for Linux ARM SL • CODESYS Control for Linux SL • CODESYS Control for PFC100 SL • CODESYS Control for PFC200 SL • CODESYS Control for PLCnext SL • CODESYS Control for Raspberry Pi SL • CODESYS Control for WAGO Touch Panels 600 SL The products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area.

  • FixedCustom Firmware <03.10.11(70) installed on WAGO PFC100 G1 0750-810x/xxxx-xxxxwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedCustom Firmware <03.10.11(70) installed on WAGO PFC200 G1 0750-820x/xxx-xxxwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedCustom Firmware <04.06.01(70) installed on WAGO Edge Controller 0752-8303/8000-0002wago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedCustom Firmware <04.06.01(70) installed on WAGO PFC100 G2 0750-811x/xxxx-xxxxwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedCustom Firmware <04.06.01(70) installed on WAGO PFC200 G2 0750-821x/xxx-xxxwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedCustom Firmware <04.06.01(70) installed on WAGO TP600 0762-420x/8000-000xwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedCustom Firmware <04.06.01(70) installed on WAGO TP600 0762-430x/8000-000xwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedCustom Firmware <04.06.01(70) installed on WAGO TP600 0762-520x/8000-000xwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedCustom Firmware <04.06.01(70) installed on WAGO TP600 0762-530x/8000-000xwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedCustom Firmware <04.06.01(70) installed on WAGO TP600 0762-620x/8000-000xwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedCustom Firmware <04.06.01(70) installed on WAGO TP600 0762-630x/8000-000xwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedCustom Firmware <04.06.03(70) installed on WAGO CC100 0751/9x01wago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedWAGO Firmware <3.10.11 (FW22 Patch 2) installed on WAGO PFC100 G1 0750-810x/xxxx-xxxxwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedWAGO Firmware <3.10.11 (FW22 Patch 2) installed on WAGO PFC200 G1 0750-820x/xxx-xxxwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedWAGO Firmware <4.5.10 (FW27) installed on WAGO CC100 0751/9x01wago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedWAGO Firmware <4.5.10 (FW27) installed on WAGO Edge Controller 0752-8303/8000-0002wago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedWAGO Firmware <4.5.10 (FW27) installed on WAGO PFC100 G2 0750-811x/xxxx-xxxxwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedWAGO Firmware <4.5.10 (FW27) installed on WAGO PFC200 G2 0750-821x/xxx-xxxwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedWAGO Firmware <4.5.10 (FW27) installed on WAGO TP600 0762-420x/8000-000xwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedWAGO Firmware <4.5.10 (FW27) installed on WAGO TP600 0762-430x/8000-000xwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedWAGO Firmware <4.5.10 (FW27) installed on WAGO TP600 0762-520x/8000-000xwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedWAGO Firmware <4.5.10 (FW27) installed on WAGO TP600 0762-530x/8000-000xwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedWAGO Firmware <4.5.10 (FW27) installed on WAGO TP600 0762-620x/8000-000xwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • FixedWAGO Firmware <4.5.10 (FW27) installed on WAGO TP600 0762-630x/8000-000xwago_psirt

    Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0festo_psirt

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10festo_psirt

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • Mitigationcodesys_psirt

    To exploit this vulnerability, a successful login with according user rights to download a PLC application is required. The online user management therefore protects from exploiting this security vulnerability. CODESYS GmbH strongly recommends using the online user management. This not only prevents an attacker from downloading virulent code or sending malicious requests, but also suppresses starting, stopping, debugging or other actions on a known working application that could potentially disrupt a machine or system. As of version 3.5.17.0, the online user management is enforced by default.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0cisa_csaf_ot

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10cisa_csaf_ot

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • WorkaroundCustom Firmware <03.10.11(70) installed on WAGO PFC100 G1 0750-810x/xxxx-xxxxwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundCustom Firmware <03.10.11(70) installed on WAGO PFC200 G1 0750-820x/xxx-xxxwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundCustom Firmware <04.06.01(70) installed on WAGO Edge Controller 0752-8303/8000-0002wago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundCustom Firmware <04.06.01(70) installed on WAGO PFC100 G2 0750-811x/xxxx-xxxxwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundCustom Firmware <04.06.01(70) installed on WAGO PFC200 G2 0750-821x/xxx-xxxwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundCustom Firmware <04.06.01(70) installed on WAGO TP600 0762-420x/8000-000xwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundCustom Firmware <04.06.01(70) installed on WAGO TP600 0762-430x/8000-000xwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundCustom Firmware <04.06.01(70) installed on WAGO TP600 0762-520x/8000-000xwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundCustom Firmware <04.06.01(70) installed on WAGO TP600 0762-530x/8000-000xwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundCustom Firmware <04.06.01(70) installed on WAGO TP600 0762-620x/8000-000xwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundCustom Firmware <04.06.01(70) installed on WAGO TP600 0762-630x/8000-000xwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundCustom Firmware <04.06.03(70) installed on WAGO CC100 0751/9x01wago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundWAGO Firmware <3.10.11 (FW22 Patch 2) installed on WAGO PFC100 G1 0750-810x/xxxx-xxxxwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundWAGO Firmware <3.10.11 (FW22 Patch 2) installed on WAGO PFC200 G1 0750-820x/xxx-xxxwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundWAGO Firmware <4.5.10 (FW27) installed on WAGO CC100 0751/9x01wago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundWAGO Firmware <4.5.10 (FW27) installed on WAGO Edge Controller 0752-8303/8000-0002wago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundWAGO Firmware <4.5.10 (FW27) installed on WAGO PFC100 G2 0750-811x/xxxx-xxxxwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundWAGO Firmware <4.5.10 (FW27) installed on WAGO PFC200 G2 0750-821x/xxx-xxxwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundWAGO Firmware <4.5.10 (FW27) installed on WAGO TP600 0762-420x/8000-000xwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundWAGO Firmware <4.5.10 (FW27) installed on WAGO TP600 0762-430x/8000-000xwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundWAGO Firmware <4.5.10 (FW27) installed on WAGO TP600 0762-520x/8000-000xwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundWAGO Firmware <4.5.10 (FW27) installed on WAGO TP600 0762-530x/8000-000xwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundWAGO Firmware <4.5.10 (FW27) installed on WAGO TP600 0762-620x/8000-000xwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

  • WorkaroundWAGO Firmware <4.5.10 (FW27) installed on WAGO TP600 0762-630x/8000-000xwago_psirt

    The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

02

cvss

Technical severity, 0–10. One row per scoring source.

8.8
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · info@cert.vde.comexploitability 2.8 · impact 5.9
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · WAGO PSIRT DE
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Festo PSIRT DE
v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ABB PSIRT
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · CODESYS PSIRT
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-78USCWE-78USCWE-78USCWE-78USCWE-78USCWE-78US
04

affected products (103)

Products and version ranges known to be affected.

showing 20 of 103
05

advisories (6)

Vendor and ecosystem advisories describing this.

  • 3ADR011377AC500 V3 Multiple vulnerabilities2025-01-07csaf · abb_psirtCH

    An update is available that resolves a publicly reported vulnerability in the product versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could call shell functions (CVE-2023-6357), crash the PLC (CVE-2024-5000), crash the web server of the PLC (CVE-2024-8175), grant read access to files (CVE-2024-12429) or enable command execution (CVE-2024-12430). The vulnerabilities CVE-2023-6357, CVE-2024-12429 and CVE-2024-12430 require successful authentication.

  • FSA-202601Several CODESYS vulnerabilities in Festo Automation Suite2026-02-26csaf · festo_psirtDE

    Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

  • VDE-2023-066CODESYS: OS Command Injection Vulnerability in multiple CODESYS Control products2023-12-05csaf · codesys_psirtDE

    UPDATE 29.02.2024: Removed "This version is planned for January 2024." from Solution as the updated version is released.On CODESYS Control runtimes running on Linux or QNX operating systems, successfully authenticated PLC programmers can utilize SysFile or CAA-File system libraries to inject calls to additional shell functions.

  • VDE-2025-008WAGO: Vulnerabilities in CODESYS Control2025-02-04csaf · wago_psirtDE

    The following firmware versions installed on several devices are are vulnerable due to a vulnerability in CODESYS Control.

  • WID-SEC-W-2024-0943CODESYS: Mehrere SchwachstellenDeutsch2024-04-21csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in CODESYS ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder einen Brute-Force-Angriff durchzuführen.

  • ICSA-26-076-01CODESYS in Festo Automation Suite2026-02-26icsa · cisa_csaf_otUS

    Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdabb_psirtcert_bundcisa_csaf_otcodesys_psirtfesto_psirtwago_psirtNVDCVE.orgMITRE
published 2023-12-05modified 2026-06-17
08

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan