Search criteria
46 vulnerabilities found for 750-8210_firmware by wago
CVE-2023-1620 (GCVE-0-2023-1620)
Vulnerability from nvd – Published: 2023-06-26 06:19 – Updated: 2024-11-12 14:11
VLAI?
Title
WAGO: DoS in multiple products in multiple versions using Codesys
Summary
Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime.
Severity ?
4.9 (Medium)
CWE
- CWE-1288 - Improper Validation of Consistency within Input
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Wago | 750-8202/xxx-xxx |
Affected:
FW1 , ≤ FW22 SP1
(custom)
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Credits
Daniel dos Santos from Forescout
Abdelrahman Hassanien from Forescout
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:57:24.833Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2023-006/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-1620",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:30:42.286955Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T14:11:36.673Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "750-8202/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8203/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8204/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8206/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8207/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8208/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8210/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8211/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8212/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8213/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8214/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8216/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8217/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-823",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-332",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW6",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-832/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW6",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-862",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-890/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-891",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-893",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-331",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW14",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-829",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW14",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-831/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW14",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-852",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-880/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-881",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-882",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-885/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-889",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Daniel dos Santos from Forescout"
},
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Abdelrahman Hassanien from Forescout"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime."
}
],
"value": "Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1288",
"description": "CWE-1288 Improper Validation of Consistency within Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T05:28:51.078Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2023-006/"
}
],
"source": {
"advisory": "VDE-2023-006",
"defect": [
"CERT@VDE#64417"
],
"discovery": "UNKNOWN"
},
"title": "WAGO: DoS in multiple products in multiple versions using Codesys",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2023-1620",
"datePublished": "2023-06-26T06:19:30.928Z",
"dateReserved": "2023-03-24T10:12:26.426Z",
"dateUpdated": "2024-11-12T14:11:36.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-1619 (GCVE-0-2023-1619)
Vulnerability from nvd – Published: 2023-06-26 06:18 – Updated: 2024-10-02 05:28
VLAI?
Title
WAGO: DoS in multiple versions of multiple products
Summary
Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a malformed packet.
Severity ?
4.9 (Medium)
CWE
- CWE-1288 - Improper Validation of Consistency within Input
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Wago | 750-8202/xxx-xxx |
Affected:
FW1 , ≤ FW22 SP1
(custom)
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Credits
Daniel dos Santos from Forescout
Abdelrahman Hassanien from Forescout
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:57:24.337Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2023-006/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "750-8202/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8203/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8204/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8206/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8207/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8208/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8210/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8211/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8212/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8213/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8214/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8216/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8217/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-823",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-332",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW6",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-832/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW6",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-862",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-890/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-891",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-893",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-331",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW14",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-829",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW14",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-831/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW14",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-852",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-880/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-881",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-882",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-885/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-889",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Daniel dos Santos from Forescout"
},
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Abdelrahman Hassanien from Forescout"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a malformed packet."
}
],
"value": "Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a malformed packet."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1288",
"description": "CWE-1288 Improper Validation of Consistency within Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T05:28:23.250Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2023-006/"
}
],
"source": {
"advisory": "VDE-2023-006",
"defect": [
"CERT@VDE#64417"
],
"discovery": "UNKNOWN"
},
"title": "WAGO: DoS in multiple versions of multiple products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2023-1619",
"datePublished": "2023-06-26T06:18:33.981Z",
"dateReserved": "2023-03-24T10:12:25.218Z",
"dateUpdated": "2024-10-02T05:28:23.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-12069 (GCVE-0-2020-12069)
Vulnerability from nvd – Published: 2022-12-26 00:00 – Updated: 2025-04-14 16:17
VLAI?
Title
CODESYS V3 prone to Inadequate Password Hashing
Summary
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.
Severity ?
7.8 (High)
CWE
- CWE-916 - Use of Password Hash With Insufficient Computational Effort
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V3 containing the CmpUserMgr |
Affected:
V3 , < V3.5.16.0
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:48:58.230Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=12943\u0026token=d097958a67ba382de688916f77e3013c0802fade\u0026download="
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-061/"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-031/"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-022/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-12069",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T16:17:42.834492Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-14T16:17:54.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CODESYS V3 containing the CmpUserMgr",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V3.5.16.0",
"status": "affected",
"version": "V3",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device."
}
],
"value": "In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-916",
"description": "CWE-916 Use of Password Hash With Insufficient Computational Effort",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-15T05:40:17.087Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=12943\u0026token=d097958a67ba382de688916f77e3013c0802fade\u0026download="
},
{
"tags": [
"vendor-advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-061/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-031/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-022/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CODESYS V3 prone to Inadequate Password Hashing",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-12069",
"datePublished": "2022-12-26T00:00:00.000Z",
"dateReserved": "2020-04-22T00:00:00.000Z",
"dateUpdated": "2025-04-14T16:17:54.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-3281 (GCVE-0-2022-3281)
Vulnerability from nvd – Published: 2022-10-17 08:20 – Updated: 2025-05-10 02:56
VLAI?
Title
WAGO: multiple products - Loss of MAC-Address-Filtering after reboot
Summary
WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. This may allow an remote attacker to circumvent the reach the network that should be protected by the MAC address filter.
Severity ?
7.5 (High)
CWE
- CWE-440 - Expected Behavior Violation
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| WAGO | 750-81xx/xxx-xxx Series PFC100/PFC200 |
Affected:
03.01.07(13) , ≤ 03.10.08(22)
(custom)
|
|||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:07:06.534Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-042/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-3281",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-10T02:56:08.488527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-10T02:56:32.932Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "750-81xx/xxx-xxx Series PFC100/PFC200",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.10.08(22)",
"status": "affected",
"version": "03.01.07(13)",
"versionType": "custom"
}
]
},
{
"product": "750-8217/xxx-xxx Series PFC100/PFC200",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.10.08(22)",
"status": "affected",
"version": "03.04.10(16)",
"versionType": "custom"
}
]
},
{
"product": "750-82xx/xxx-xxx Series PFC100/PFC200",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.10.08(22)",
"status": "affected",
"version": "03.01.07(13)",
"versionType": "custom"
}
]
},
{
"product": "Compact Controller CC100",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.09.08(21)",
"status": "affected",
"version": "03.07.17(19)",
"versionType": "custom"
}
]
},
{
"product": "762-4xxx Series Touch Panel 600",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.10.09(22)",
"status": "affected",
"version": "03.01.07(13)",
"versionType": "custom"
}
]
},
{
"product": "762-5xxx Series Touch Panel 600",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.10.09(22)",
"status": "affected",
"version": "03.01.07(13)",
"versionType": "custom"
}
]
},
{
"product": "762-6xxx Series Touch Panel 600",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.10.09(22)",
"status": "affected",
"version": "03.01.07(13)",
"versionType": "custom"
}
]
},
{
"product": "752-8303/8000-002 Edge Controller",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.10.09(22)",
"status": "affected",
"version": "03.06.09(18)",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-10-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. This may allow an remote attacker to circumvent the reach the network that should be protected by the MAC address filter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-440",
"description": "CWE-440 Expected Behavior Violation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-02T00:00:00.000Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://cert.vde.com/en/advisories/VDE-2022-042/"
}
],
"source": {
"advisory": "VDE-2022-042",
"defect": [
"CERT@VDE#64236"
],
"discovery": "INTERNAL"
},
"title": "WAGO: multiple products - Loss of MAC-Address-Filtering after reboot",
"x_generator": {
"engine": "vulnogram 0.1.0-rc1"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2022-3281",
"datePublished": "2022-10-17T08:20:12.389Z",
"dateReserved": "2022-09-23T00:00:00.000Z",
"dateUpdated": "2025-05-10T02:56:32.932Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34596 (GCVE-0-2021-34596)
Vulnerability from nvd – Published: 2021-10-26 09:55 – Updated: 2024-09-16 22:40
VLAI?
Title
CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service
Summary
A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition.
Severity ?
6.5 (Medium)
CWE
- CWE-824 - Access of Uninitialized Pointer
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V2 |
Affected:
Runtime Toolkit 32 bit full , < V2.4.7.56
(custom)
Affected: PLCWinNT , < V2.4.7.56 (custom) |
Credits
This issue was reported by Gao Jian of NSFOCUS.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:47.653Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CODESYS V2",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V2.4.7.56",
"status": "affected",
"version": "Runtime Toolkit 32 bit full",
"versionType": "custom"
},
{
"lessThan": "V2.4.7.56",
"status": "affected",
"version": "PLCWinNT",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was reported by Gao Jian of NSFOCUS."
}
],
"datePublic": "2021-10-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-824",
"description": "CWE-824 Access of Uninitialized Pointer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-26T09:55:54",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download="
}
],
"solutions": [
{
"lang": "en",
"value": "CODESYS GmbH has released the following product versions to solve the noted vulnerability issue for the affected CODESYS products:\n * CODESYS Runtime Toolkit 32 bit full version V2.4.7.56\n * CODESYS PLCWinNT version V2.4.7.56. This will also be part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-10-25T14:00:00.000Z",
"ID": "CVE-2021-34596",
"STATE": "PUBLIC",
"TITLE": "CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CODESYS V2",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "Runtime Toolkit 32 bit full",
"version_value": "V2.4.7.56"
},
{
"version_affected": "\u003c",
"version_name": "PLCWinNT",
"version_value": "V2.4.7.56"
}
]
}
}
]
},
"vendor_name": "CODESYS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was reported by Gao Jian of NSFOCUS."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-824 Access of Uninitialized Pointer"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download=",
"refsource": "CONFIRM",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download="
}
]
},
"solution": [
{
"lang": "en",
"value": "CODESYS GmbH has released the following product versions to solve the noted vulnerability issue for the affected CODESYS products:\n * CODESYS Runtime Toolkit 32 bit full version V2.4.7.56\n * CODESYS PLCWinNT version V2.4.7.56. This will also be part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-34596",
"datePublished": "2021-10-26T09:55:54.408529Z",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-09-16T22:40:47.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34595 (GCVE-0-2021-34595)
Vulnerability from nvd – Published: 2021-10-26 09:55 – Updated: 2024-09-17 03:42
VLAI?
Title
CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service
Summary
A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite.
Severity ?
8.1 (High)
CWE
- CWE-823 - Use of Out-of-range Pointer Offset
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V2 |
Affected:
Runtime Toolkit 32 bit full , < V2.4.7.56
(custom)
Affected: PLCWinNT , < V2.4.7.56 (custom) |
Credits
This issue was reported by Chen Jie and Gao Jian of NSFOCUS.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:47.024Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CODESYS V2",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V2.4.7.56",
"status": "affected",
"version": "Runtime Toolkit 32 bit full",
"versionType": "custom"
},
{
"lessThan": "V2.4.7.56",
"status": "affected",
"version": "PLCWinNT",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was reported by Chen Jie and Gao Jian of NSFOCUS."
}
],
"datePublic": "2021-10-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-823",
"description": "CWE-823 Use of Out-of-range Pointer Offset",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-26T09:55:52",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download="
}
],
"solutions": [
{
"lang": "en",
"value": "CODESYS GmbH has released the following product versions to solve the noted vulnerability issue for the affected CODESYS products:\n * CODESYS Runtime Toolkit 32 bit full version V2.4.7.56\n * CODESYS PLCWinNT version V2.4.7.56. This will also be part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-10-25T14:00:00.000Z",
"ID": "CVE-2021-34595",
"STATE": "PUBLIC",
"TITLE": "CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CODESYS V2",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "Runtime Toolkit 32 bit full",
"version_value": "V2.4.7.56"
},
{
"version_affected": "\u003c",
"version_name": "PLCWinNT",
"version_value": "V2.4.7.56"
}
]
}
}
]
},
"vendor_name": "CODESYS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was reported by Chen Jie and Gao Jian of NSFOCUS."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-823 Use of Out-of-range Pointer Offset"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download=",
"refsource": "CONFIRM",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download="
}
]
},
"solution": [
{
"lang": "en",
"value": "CODESYS GmbH has released the following product versions to solve the noted vulnerability issue for the affected CODESYS products:\n * CODESYS Runtime Toolkit 32 bit full version V2.4.7.56\n * CODESYS PLCWinNT version V2.4.7.56. This will also be part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-34595",
"datePublished": "2021-10-26T09:55:52.868387Z",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-09-17T03:42:53.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34593 (GCVE-0-2021-34593)
Vulnerability from nvd – Published: 2021-10-26 09:55 – Updated: 2024-09-17 04:10
VLAI?
Title
CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service
Summary
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC.
Severity ?
7.5 (High)
CWE
- CWE-755 - Improper Handling of Exceptional Conditions
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V2 |
Affected:
Runtime Toolkit 32 bit full , < V2.4.7.56
(custom)
Affected: PLCWinNT , < V2.4.7.56 (custom) |
Credits
This issue was discovered by Steffen Robertz and Gerhard Hechenberger from the SEC Consult Vulnerability Lab.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:47.007Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16877\u0026token=8faab0fc1e069f4edfca5d5aba8146139f67a175\u0026download="
},
{
"name": "20211029 SEC Consult SA-20211028-0 :: Denial of Service in CODESYS V2",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2021/Oct/64"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/164716/CODESYS-2.4.7.0-Denial-Of-Service.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165874/WAGO-750-8xxx-PLC-Denial-Of-Service-User-Enumeration.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CODESYS V2",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V2.4.7.56",
"status": "affected",
"version": "Runtime Toolkit 32 bit full",
"versionType": "custom"
},
{
"lessThan": "V2.4.7.56",
"status": "affected",
"version": "PLCWinNT",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Steffen Robertz and Gerhard Hechenberger from the SEC Consult Vulnerability Lab."
}
],
"datePublic": "2021-10-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "CWE-755 Improper Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-04T19:06:19",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16877\u0026token=8faab0fc1e069f4edfca5d5aba8146139f67a175\u0026download="
},
{
"name": "20211029 SEC Consult SA-20211028-0 :: Denial of Service in CODESYS V2",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2021/Oct/64"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/164716/CODESYS-2.4.7.0-Denial-Of-Service.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/165874/WAGO-750-8xxx-PLC-Denial-Of-Service-User-Enumeration.html"
}
],
"solutions": [
{
"lang": "en",
"value": "CODESYS GmbH has released the following product versions to solve the noted vulnerability issue for the affected CODESYS products:\n * CODESYS Runtime Toolkit 32 bit full version V2.4.7.56\n * CODESYS PLCWinNT version V2.4.7.56. This will also be part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"defect": [
"VDE-2021-049"
],
"discovery": "EXTERNAL"
},
"title": "CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-10-25T14:00:00.000Z",
"ID": "CVE-2021-34593",
"STATE": "PUBLIC",
"TITLE": "CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CODESYS V2",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "Runtime Toolkit 32 bit full",
"version_value": "V2.4.7.56"
},
{
"version_affected": "\u003c",
"version_name": "PLCWinNT",
"version_value": "V2.4.7.56"
}
]
}
}
]
},
"vendor_name": "CODESYS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was discovered by Steffen Robertz and Gerhard Hechenberger from the SEC Consult Vulnerability Lab."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-755 Improper Handling of Exceptional Conditions"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16877\u0026token=8faab0fc1e069f4edfca5d5aba8146139f67a175\u0026download=",
"refsource": "CONFIRM",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16877\u0026token=8faab0fc1e069f4edfca5d5aba8146139f67a175\u0026download="
},
{
"name": "20211029 SEC Consult SA-20211028-0 :: Denial of Service in CODESYS V2",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2021/Oct/64"
},
{
"name": "http://packetstormsecurity.com/files/164716/CODESYS-2.4.7.0-Denial-Of-Service.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/164716/CODESYS-2.4.7.0-Denial-Of-Service.html"
},
{
"name": "http://packetstormsecurity.com/files/165874/WAGO-750-8xxx-PLC-Denial-Of-Service-User-Enumeration.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/165874/WAGO-750-8xxx-PLC-Denial-Of-Service-User-Enumeration.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "CODESYS GmbH has released the following product versions to solve the noted vulnerability issue for the affected CODESYS products:\n * CODESYS Runtime Toolkit 32 bit full version V2.4.7.56\n * CODESYS PLCWinNT version V2.4.7.56. This will also be part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"defect": [
"VDE-2021-049"
],
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-34593",
"datePublished": "2021-10-26T09:55:51.381906Z",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-09-17T04:10:03.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34586 (GCVE-0-2021-34586)
Vulnerability from nvd – Published: 2021-10-26 09:55 – Updated: 2024-09-17 03:53
VLAI?
Title
CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS)
Summary
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service condition.
Severity ?
7.5 (High)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V2 |
Affected:
all web servers , < V1.1.9.22
(custom)
|
Credits
This vulnerability was discovered by Tenable Research.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:47.010Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CODESYS V2",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V1.1.9.22",
"status": "affected",
"version": "all web servers",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"datePublic": "2021-10-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service condition."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-26T19:06:10",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"solutions": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS)",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-10-25T14:00:00.000Z",
"ID": "CVE-2021-34586",
"STATE": "PUBLIC",
"TITLE": "CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CODESYS V2",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "all web servers",
"version_value": "V1.1.9.22"
}
]
}
}
]
},
"vendor_name": "CODESYS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service condition."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-476 NULL Pointer Dereference"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download=",
"refsource": "CONFIRM",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"name": "https://www.tenable.com/security/research/tra-2021-47",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
]
},
"solution": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-34586",
"datePublished": "2021-10-26T09:55:49.885522Z",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-09-17T03:53:13.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34585 (GCVE-0-2021-34585)
Vulnerability from nvd – Published: 2021-10-26 09:55 – Updated: 2024-09-16 21:58
VLAI?
Title
CODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS)
Summary
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an invalid address can occur. This leads to a denial of service situation.
Severity ?
7.5 (High)
CWE
- CWE-252 - Unchecked Return Value
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V2 |
Affected:
all web servers , < V1.1.9.22
(custom)
|
Credits
This vulnerability was discovered by Tenable Research.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:46.604Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CODESYS V2",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V1.1.9.22",
"status": "affected",
"version": "all web servers",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"datePublic": "2021-10-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an invalid address can occur. This leads to a denial of service situation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-252",
"description": "CWE-252 Unchecked Return Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-11-04T09:50:08",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"solutions": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS)",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-10-25T14:00:00.000Z",
"ID": "CVE-2021-34585",
"STATE": "PUBLIC",
"TITLE": "CODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CODESYS V2",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "all web servers",
"version_value": "V1.1.9.22"
}
]
}
}
]
},
"vendor_name": "CODESYS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an invalid address can occur. This leads to a denial of service situation."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-252 Unchecked Return Value"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download=",
"refsource": "CONFIRM",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"name": "https://www.tenable.com/security/research/tra-2021-47",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
]
},
"solution": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-34585",
"datePublished": "2021-10-26T09:55:48.273766Z",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-09-16T21:58:06.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34584 (GCVE-0-2021-34584)
Vulnerability from nvd – Published: 2021-10-26 09:55 – Updated: 2024-09-16 22:25
VLAI?
Title
CODESYS V2 web server: crafted requests could trigger a buffer over-read (DoS)
Summary
Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
Severity ?
9.1 (Critical)
CWE
- CWE-126 - Buffer Over-read
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V2 |
Affected:
all web servers , < V1.1.9.22
(custom)
|
Credits
This vulnerability was discovered by Tenable Research.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:46.979Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CODESYS V2",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V1.1.9.22",
"status": "affected",
"version": "all web servers",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"datePublic": "2021-10-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-126",
"description": "CWE-126 Buffer Over-read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-28T14:30:20",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"solutions": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CODESYS V2 web server: crafted requests could trigger a buffer over-read (DoS)",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-10-25T14:00:00.000Z",
"ID": "CVE-2021-34584",
"STATE": "PUBLIC",
"TITLE": "CODESYS V2 web server: crafted requests could trigger a buffer over-read (DoS)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CODESYS V2",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "all web servers",
"version_value": "V1.1.9.22"
}
]
}
}
]
},
"vendor_name": "CODESYS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-126 Buffer Over-read"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download=",
"refsource": "CONFIRM",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"name": "https://www.tenable.com/security/research/tra-2021-47",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
]
},
"solution": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-34584",
"datePublished": "2021-10-26T09:55:46.638935Z",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-09-16T22:25:58.664Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34583 (GCVE-0-2021-34583)
Vulnerability from nvd – Published: 2021-10-26 09:55 – Updated: 2024-09-16 20:43
VLAI?
Title
CODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS)
Summary
Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
Severity ?
7.5 (High)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V2 |
Affected:
all web servers , < V1.1.9.22
(custom)
|
Credits
This vulnerability was discovered by Tenable Research.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:46.979Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CODESYS V2",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V1.1.9.22",
"status": "affected",
"version": "all web servers",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"datePublic": "2021-10-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-26T19:06:12",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"solutions": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS)",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-10-25T14:00:00.000Z",
"ID": "CVE-2021-34583",
"STATE": "PUBLIC",
"TITLE": "CODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CODESYS V2",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "all web servers",
"version_value": "V1.1.9.22"
}
]
}
}
]
},
"vendor_name": "CODESYS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-122 Heap-based Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download=",
"refsource": "CONFIRM",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"name": "https://www.tenable.com/security/research/tra-2021-47",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
]
},
"solution": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-34583",
"datePublished": "2021-10-26T09:55:45.129967Z",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-09-16T20:43:32.357Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-30195 (GCVE-0-2021-30195)
Vulnerability from nvd – Published: 2021-05-25 12:33 – Updated: 2024-08-03 22:24
VLAI?
Summary
CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.565Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14725\u0026token=08691519ef764b252630759eff925890176ecd78\u0026download="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-25T12:33:21",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14725\u0026token=08691519ef764b252630759eff925890176ecd78\u0026download="
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-30195",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php"
},
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14725\u0026token=08691519ef764b252630759eff925890176ecd78\u0026download=",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14725\u0026token=08691519ef764b252630759eff925890176ecd78\u0026download="
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-30195",
"datePublished": "2021-05-25T12:33:21",
"dateReserved": "2021-04-07T00:00:00",
"dateUpdated": "2024-08-03T22:24:59.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-30194 (GCVE-0-2021-30194)
Vulnerability from nvd – Published: 2021-05-25 12:09 – Updated: 2024-08-03 22:24
VLAI?
Summary
CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.599Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-25T12:09:38",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-30194",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php"
},
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download=",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-30194",
"datePublished": "2021-05-25T12:09:38",
"dateReserved": "2021-04-07T00:00:00",
"dateUpdated": "2024-08-03T22:24:59.599Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-30193 (GCVE-0-2021-30193)
Vulnerability from nvd – Published: 2021-05-25 12:09 – Updated: 2024-08-03 22:24
VLAI?
Summary
CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.625Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-25T12:09:33",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-30193",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php"
},
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download=",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-30193",
"datePublished": "2021-05-25T12:09:33",
"dateReserved": "2021-04-07T00:00:00",
"dateUpdated": "2024-08-03T22:24:59.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-30192 (GCVE-0-2021-30192)
Vulnerability from nvd – Published: 2021-05-25 12:09 – Updated: 2024-08-03 22:24
VLAI?
Summary
CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.647Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-25T12:09:28",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-30192",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php"
},
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download=",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-30192",
"datePublished": "2021-05-25T12:09:28",
"dateReserved": "2021-04-07T00:00:00",
"dateUpdated": "2024-08-03T22:24:59.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-30191 (GCVE-0-2021-30191)
Vulnerability from nvd – Published: 2021-05-25 12:09 – Updated: 2024-08-03 22:24
VLAI?
Summary
CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.674Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-25T12:09:22",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-30191",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php"
},
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download=",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-30191",
"datePublished": "2021-05-25T12:09:22",
"dateReserved": "2021-04-07T00:00:00",
"dateUpdated": "2024-08-03T22:24:59.674Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-30190 (GCVE-0-2021-30190)
Vulnerability from nvd – Published: 2021-05-25 12:09 – Updated: 2024-08-03 22:24
VLAI?
Summary
CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.673Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-25T12:09:16",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-30190",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php"
},
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download=",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-30190",
"datePublished": "2021-05-25T12:09:16",
"dateReserved": "2021-04-07T00:00:00",
"dateUpdated": "2024-08-03T22:24:59.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-30189 (GCVE-0-2021-30189)
Vulnerability from nvd – Published: 2021-05-25 12:09 – Updated: 2024-08-03 22:24
VLAI?
Summary
CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.628Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-25T12:09:10",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-30189",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php"
},
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download=",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14726\u0026token=553da5d11234bbe1ceed59969d419a71bb8c8747\u0026download="
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-30189",
"datePublished": "2021-05-25T12:09:10",
"dateReserved": "2021-04-07T00:00:00",
"dateUpdated": "2024-08-03T22:24:59.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-30188 (GCVE-0-2021-30188)
Vulnerability from nvd – Published: 2021-05-25 12:33 – Updated: 2024-08-03 22:24
VLAI?
Summary
CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:24:59.559Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14725\u0026token=08691519ef764b252630759eff925890176ecd78\u0026download="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-25T12:33:16",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14725\u0026token=08691519ef764b252630759eff925890176ecd78\u0026download="
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-30188",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php"
},
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14725\u0026token=08691519ef764b252630759eff925890176ecd78\u0026download=",
"refsource": "MISC",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=14725\u0026token=08691519ef764b252630759eff925890176ecd78\u0026download="
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-30188",
"datePublished": "2021-05-25T12:33:16",
"dateReserved": "2021-04-07T00:00:00",
"dateUpdated": "2024-08-03T22:24:59.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-1620 (GCVE-0-2023-1620)
Vulnerability from cvelistv5 – Published: 2023-06-26 06:19 – Updated: 2024-11-12 14:11
VLAI?
Title
WAGO: DoS in multiple products in multiple versions using Codesys
Summary
Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime.
Severity ?
4.9 (Medium)
CWE
- CWE-1288 - Improper Validation of Consistency within Input
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Wago | 750-8202/xxx-xxx |
Affected:
FW1 , ≤ FW22 SP1
(custom)
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Credits
Daniel dos Santos from Forescout
Abdelrahman Hassanien from Forescout
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:57:24.833Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2023-006/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-1620",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T20:30:42.286955Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T14:11:36.673Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "750-8202/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8203/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8204/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8206/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8207/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8208/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8210/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8211/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8212/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8213/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8214/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8216/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8217/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-823",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-332",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW6",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-832/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW6",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-862",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-890/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-891",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-893",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-331",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW14",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-829",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW14",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-831/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW14",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-852",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-880/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-881",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-882",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-885/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-889",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Daniel dos Santos from Forescout"
},
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Abdelrahman Hassanien from Forescout"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime."
}
],
"value": "Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1288",
"description": "CWE-1288 Improper Validation of Consistency within Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T05:28:51.078Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2023-006/"
}
],
"source": {
"advisory": "VDE-2023-006",
"defect": [
"CERT@VDE#64417"
],
"discovery": "UNKNOWN"
},
"title": "WAGO: DoS in multiple products in multiple versions using Codesys",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2023-1620",
"datePublished": "2023-06-26T06:19:30.928Z",
"dateReserved": "2023-03-24T10:12:26.426Z",
"dateUpdated": "2024-11-12T14:11:36.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-1619 (GCVE-0-2023-1619)
Vulnerability from cvelistv5 – Published: 2023-06-26 06:18 – Updated: 2024-10-02 05:28
VLAI?
Title
WAGO: DoS in multiple versions of multiple products
Summary
Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a malformed packet.
Severity ?
4.9 (Medium)
CWE
- CWE-1288 - Improper Validation of Consistency within Input
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Wago | 750-8202/xxx-xxx |
Affected:
FW1 , ≤ FW22 SP1
(custom)
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Credits
Daniel dos Santos from Forescout
Abdelrahman Hassanien from Forescout
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:57:24.337Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2023-006/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "750-8202/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8203/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8204/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8206/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8207/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8208/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8210/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8211/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8212/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8213/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8214/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8216/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-8217/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW22 SP1",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-823",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-332",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW6",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-832/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW6",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-862",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-890/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-891",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-893",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW10",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-331",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW14",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-829",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW14",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-831/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW14",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-852",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-880/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-881",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-882",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-885/xxx-xxx",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "750-889",
"vendor": "Wago",
"versions": [
{
"lessThanOrEqual": "FW16",
"status": "affected",
"version": "FW1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Daniel dos Santos from Forescout"
},
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Abdelrahman Hassanien from Forescout"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a malformed packet."
}
],
"value": "Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a malformed packet."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1288",
"description": "CWE-1288 Improper Validation of Consistency within Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T05:28:23.250Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2023-006/"
}
],
"source": {
"advisory": "VDE-2023-006",
"defect": [
"CERT@VDE#64417"
],
"discovery": "UNKNOWN"
},
"title": "WAGO: DoS in multiple versions of multiple products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2023-1619",
"datePublished": "2023-06-26T06:18:33.981Z",
"dateReserved": "2023-03-24T10:12:25.218Z",
"dateUpdated": "2024-10-02T05:28:23.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-12069 (GCVE-0-2020-12069)
Vulnerability from cvelistv5 – Published: 2022-12-26 00:00 – Updated: 2025-04-14 16:17
VLAI?
Title
CODESYS V3 prone to Inadequate Password Hashing
Summary
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.
Severity ?
7.8 (High)
CWE
- CWE-916 - Use of Password Hash With Insufficient Computational Effort
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V3 containing the CmpUserMgr |
Affected:
V3 , < V3.5.16.0
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:48:58.230Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=12943\u0026token=d097958a67ba382de688916f77e3013c0802fade\u0026download="
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-061/"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-031/"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-022/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-12069",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T16:17:42.834492Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-14T16:17:54.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CODESYS V3 containing the CmpUserMgr",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V3.5.16.0",
"status": "affected",
"version": "V3",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device."
}
],
"value": "In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-916",
"description": "CWE-916 Use of Password Hash With Insufficient Computational Effort",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-15T05:40:17.087Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=12943\u0026token=d097958a67ba382de688916f77e3013c0802fade\u0026download="
},
{
"tags": [
"vendor-advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-061/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-031/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-022/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CODESYS V3 prone to Inadequate Password Hashing",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-12069",
"datePublished": "2022-12-26T00:00:00.000Z",
"dateReserved": "2020-04-22T00:00:00.000Z",
"dateUpdated": "2025-04-14T16:17:54.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-3281 (GCVE-0-2022-3281)
Vulnerability from cvelistv5 – Published: 2022-10-17 08:20 – Updated: 2025-05-10 02:56
VLAI?
Title
WAGO: multiple products - Loss of MAC-Address-Filtering after reboot
Summary
WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. This may allow an remote attacker to circumvent the reach the network that should be protected by the MAC address filter.
Severity ?
7.5 (High)
CWE
- CWE-440 - Expected Behavior Violation
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| WAGO | 750-81xx/xxx-xxx Series PFC100/PFC200 |
Affected:
03.01.07(13) , ≤ 03.10.08(22)
(custom)
|
|||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:07:06.534Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-042/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-3281",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-10T02:56:08.488527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-10T02:56:32.932Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "750-81xx/xxx-xxx Series PFC100/PFC200",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.10.08(22)",
"status": "affected",
"version": "03.01.07(13)",
"versionType": "custom"
}
]
},
{
"product": "750-8217/xxx-xxx Series PFC100/PFC200",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.10.08(22)",
"status": "affected",
"version": "03.04.10(16)",
"versionType": "custom"
}
]
},
{
"product": "750-82xx/xxx-xxx Series PFC100/PFC200",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.10.08(22)",
"status": "affected",
"version": "03.01.07(13)",
"versionType": "custom"
}
]
},
{
"product": "Compact Controller CC100",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.09.08(21)",
"status": "affected",
"version": "03.07.17(19)",
"versionType": "custom"
}
]
},
{
"product": "762-4xxx Series Touch Panel 600",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.10.09(22)",
"status": "affected",
"version": "03.01.07(13)",
"versionType": "custom"
}
]
},
{
"product": "762-5xxx Series Touch Panel 600",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.10.09(22)",
"status": "affected",
"version": "03.01.07(13)",
"versionType": "custom"
}
]
},
{
"product": "762-6xxx Series Touch Panel 600",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.10.09(22)",
"status": "affected",
"version": "03.01.07(13)",
"versionType": "custom"
}
]
},
{
"product": "752-8303/8000-002 Edge Controller",
"vendor": "WAGO",
"versions": [
{
"lessThanOrEqual": "03.10.09(22)",
"status": "affected",
"version": "03.06.09(18)",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-10-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. This may allow an remote attacker to circumvent the reach the network that should be protected by the MAC address filter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-440",
"description": "CWE-440 Expected Behavior Violation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-02T00:00:00.000Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://cert.vde.com/en/advisories/VDE-2022-042/"
}
],
"source": {
"advisory": "VDE-2022-042",
"defect": [
"CERT@VDE#64236"
],
"discovery": "INTERNAL"
},
"title": "WAGO: multiple products - Loss of MAC-Address-Filtering after reboot",
"x_generator": {
"engine": "vulnogram 0.1.0-rc1"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2022-3281",
"datePublished": "2022-10-17T08:20:12.389Z",
"dateReserved": "2022-09-23T00:00:00.000Z",
"dateUpdated": "2025-05-10T02:56:32.932Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34596 (GCVE-0-2021-34596)
Vulnerability from cvelistv5 – Published: 2021-10-26 09:55 – Updated: 2024-09-16 22:40
VLAI?
Title
CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service
Summary
A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition.
Severity ?
6.5 (Medium)
CWE
- CWE-824 - Access of Uninitialized Pointer
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V2 |
Affected:
Runtime Toolkit 32 bit full , < V2.4.7.56
(custom)
Affected: PLCWinNT , < V2.4.7.56 (custom) |
Credits
This issue was reported by Gao Jian of NSFOCUS.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:47.653Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CODESYS V2",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V2.4.7.56",
"status": "affected",
"version": "Runtime Toolkit 32 bit full",
"versionType": "custom"
},
{
"lessThan": "V2.4.7.56",
"status": "affected",
"version": "PLCWinNT",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was reported by Gao Jian of NSFOCUS."
}
],
"datePublic": "2021-10-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-824",
"description": "CWE-824 Access of Uninitialized Pointer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-26T09:55:54",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download="
}
],
"solutions": [
{
"lang": "en",
"value": "CODESYS GmbH has released the following product versions to solve the noted vulnerability issue for the affected CODESYS products:\n * CODESYS Runtime Toolkit 32 bit full version V2.4.7.56\n * CODESYS PLCWinNT version V2.4.7.56. This will also be part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-10-25T14:00:00.000Z",
"ID": "CVE-2021-34596",
"STATE": "PUBLIC",
"TITLE": "CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CODESYS V2",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "Runtime Toolkit 32 bit full",
"version_value": "V2.4.7.56"
},
{
"version_affected": "\u003c",
"version_name": "PLCWinNT",
"version_value": "V2.4.7.56"
}
]
}
}
]
},
"vendor_name": "CODESYS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was reported by Gao Jian of NSFOCUS."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-824 Access of Uninitialized Pointer"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download=",
"refsource": "CONFIRM",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download="
}
]
},
"solution": [
{
"lang": "en",
"value": "CODESYS GmbH has released the following product versions to solve the noted vulnerability issue for the affected CODESYS products:\n * CODESYS Runtime Toolkit 32 bit full version V2.4.7.56\n * CODESYS PLCWinNT version V2.4.7.56. This will also be part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-34596",
"datePublished": "2021-10-26T09:55:54.408529Z",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-09-16T22:40:47.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34595 (GCVE-0-2021-34595)
Vulnerability from cvelistv5 – Published: 2021-10-26 09:55 – Updated: 2024-09-17 03:42
VLAI?
Title
CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service
Summary
A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite.
Severity ?
8.1 (High)
CWE
- CWE-823 - Use of Out-of-range Pointer Offset
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V2 |
Affected:
Runtime Toolkit 32 bit full , < V2.4.7.56
(custom)
Affected: PLCWinNT , < V2.4.7.56 (custom) |
Credits
This issue was reported by Chen Jie and Gao Jian of NSFOCUS.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:47.024Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CODESYS V2",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V2.4.7.56",
"status": "affected",
"version": "Runtime Toolkit 32 bit full",
"versionType": "custom"
},
{
"lessThan": "V2.4.7.56",
"status": "affected",
"version": "PLCWinNT",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was reported by Chen Jie and Gao Jian of NSFOCUS."
}
],
"datePublic": "2021-10-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-823",
"description": "CWE-823 Use of Out-of-range Pointer Offset",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-26T09:55:52",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download="
}
],
"solutions": [
{
"lang": "en",
"value": "CODESYS GmbH has released the following product versions to solve the noted vulnerability issue for the affected CODESYS products:\n * CODESYS Runtime Toolkit 32 bit full version V2.4.7.56\n * CODESYS PLCWinNT version V2.4.7.56. This will also be part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-10-25T14:00:00.000Z",
"ID": "CVE-2021-34595",
"STATE": "PUBLIC",
"TITLE": "CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CODESYS V2",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "Runtime Toolkit 32 bit full",
"version_value": "V2.4.7.56"
},
{
"version_affected": "\u003c",
"version_name": "PLCWinNT",
"version_value": "V2.4.7.56"
}
]
}
}
]
},
"vendor_name": "CODESYS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was reported by Chen Jie and Gao Jian of NSFOCUS."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-823 Use of Out-of-range Pointer Offset"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download=",
"refsource": "CONFIRM",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16878\u0026token=e5644ec405590e66aefa62304cb8632df9fc9e9c\u0026download="
}
]
},
"solution": [
{
"lang": "en",
"value": "CODESYS GmbH has released the following product versions to solve the noted vulnerability issue for the affected CODESYS products:\n * CODESYS Runtime Toolkit 32 bit full version V2.4.7.56\n * CODESYS PLCWinNT version V2.4.7.56. This will also be part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-34595",
"datePublished": "2021-10-26T09:55:52.868387Z",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-09-17T03:42:53.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34593 (GCVE-0-2021-34593)
Vulnerability from cvelistv5 – Published: 2021-10-26 09:55 – Updated: 2024-09-17 04:10
VLAI?
Title
CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service
Summary
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC.
Severity ?
7.5 (High)
CWE
- CWE-755 - Improper Handling of Exceptional Conditions
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V2 |
Affected:
Runtime Toolkit 32 bit full , < V2.4.7.56
(custom)
Affected: PLCWinNT , < V2.4.7.56 (custom) |
Credits
This issue was discovered by Steffen Robertz and Gerhard Hechenberger from the SEC Consult Vulnerability Lab.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:47.007Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16877\u0026token=8faab0fc1e069f4edfca5d5aba8146139f67a175\u0026download="
},
{
"name": "20211029 SEC Consult SA-20211028-0 :: Denial of Service in CODESYS V2",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2021/Oct/64"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/164716/CODESYS-2.4.7.0-Denial-Of-Service.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165874/WAGO-750-8xxx-PLC-Denial-Of-Service-User-Enumeration.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CODESYS V2",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V2.4.7.56",
"status": "affected",
"version": "Runtime Toolkit 32 bit full",
"versionType": "custom"
},
{
"lessThan": "V2.4.7.56",
"status": "affected",
"version": "PLCWinNT",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Steffen Robertz and Gerhard Hechenberger from the SEC Consult Vulnerability Lab."
}
],
"datePublic": "2021-10-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "CWE-755 Improper Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-04T19:06:19",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16877\u0026token=8faab0fc1e069f4edfca5d5aba8146139f67a175\u0026download="
},
{
"name": "20211029 SEC Consult SA-20211028-0 :: Denial of Service in CODESYS V2",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2021/Oct/64"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/164716/CODESYS-2.4.7.0-Denial-Of-Service.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/165874/WAGO-750-8xxx-PLC-Denial-Of-Service-User-Enumeration.html"
}
],
"solutions": [
{
"lang": "en",
"value": "CODESYS GmbH has released the following product versions to solve the noted vulnerability issue for the affected CODESYS products:\n * CODESYS Runtime Toolkit 32 bit full version V2.4.7.56\n * CODESYS PLCWinNT version V2.4.7.56. This will also be part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"defect": [
"VDE-2021-049"
],
"discovery": "EXTERNAL"
},
"title": "CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-10-25T14:00:00.000Z",
"ID": "CVE-2021-34593",
"STATE": "PUBLIC",
"TITLE": "CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CODESYS V2",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "Runtime Toolkit 32 bit full",
"version_value": "V2.4.7.56"
},
{
"version_affected": "\u003c",
"version_name": "PLCWinNT",
"version_value": "V2.4.7.56"
}
]
}
}
]
},
"vendor_name": "CODESYS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was discovered by Steffen Robertz and Gerhard Hechenberger from the SEC Consult Vulnerability Lab."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-755 Improper Handling of Exceptional Conditions"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16877\u0026token=8faab0fc1e069f4edfca5d5aba8146139f67a175\u0026download=",
"refsource": "CONFIRM",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16877\u0026token=8faab0fc1e069f4edfca5d5aba8146139f67a175\u0026download="
},
{
"name": "20211029 SEC Consult SA-20211028-0 :: Denial of Service in CODESYS V2",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2021/Oct/64"
},
{
"name": "http://packetstormsecurity.com/files/164716/CODESYS-2.4.7.0-Denial-Of-Service.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/164716/CODESYS-2.4.7.0-Denial-Of-Service.html"
},
{
"name": "http://packetstormsecurity.com/files/165874/WAGO-750-8xxx-PLC-Denial-Of-Service-User-Enumeration.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/165874/WAGO-750-8xxx-PLC-Denial-Of-Service-User-Enumeration.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "CODESYS GmbH has released the following product versions to solve the noted vulnerability issue for the affected CODESYS products:\n * CODESYS Runtime Toolkit 32 bit full version V2.4.7.56\n * CODESYS PLCWinNT version V2.4.7.56. This will also be part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"defect": [
"VDE-2021-049"
],
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-34593",
"datePublished": "2021-10-26T09:55:51.381906Z",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-09-17T04:10:03.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34586 (GCVE-0-2021-34586)
Vulnerability from cvelistv5 – Published: 2021-10-26 09:55 – Updated: 2024-09-17 03:53
VLAI?
Title
CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS)
Summary
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service condition.
Severity ?
7.5 (High)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V2 |
Affected:
all web servers , < V1.1.9.22
(custom)
|
Credits
This vulnerability was discovered by Tenable Research.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:47.010Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CODESYS V2",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V1.1.9.22",
"status": "affected",
"version": "all web servers",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"datePublic": "2021-10-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service condition."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-26T19:06:10",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"solutions": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS)",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-10-25T14:00:00.000Z",
"ID": "CVE-2021-34586",
"STATE": "PUBLIC",
"TITLE": "CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CODESYS V2",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "all web servers",
"version_value": "V1.1.9.22"
}
]
}
}
]
},
"vendor_name": "CODESYS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service condition."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-476 NULL Pointer Dereference"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download=",
"refsource": "CONFIRM",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"name": "https://www.tenable.com/security/research/tra-2021-47",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
]
},
"solution": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-34586",
"datePublished": "2021-10-26T09:55:49.885522Z",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-09-17T03:53:13.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34585 (GCVE-0-2021-34585)
Vulnerability from cvelistv5 – Published: 2021-10-26 09:55 – Updated: 2024-09-16 21:58
VLAI?
Title
CODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS)
Summary
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an invalid address can occur. This leads to a denial of service situation.
Severity ?
7.5 (High)
CWE
- CWE-252 - Unchecked Return Value
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V2 |
Affected:
all web servers , < V1.1.9.22
(custom)
|
Credits
This vulnerability was discovered by Tenable Research.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:46.604Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CODESYS V2",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V1.1.9.22",
"status": "affected",
"version": "all web servers",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"datePublic": "2021-10-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an invalid address can occur. This leads to a denial of service situation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-252",
"description": "CWE-252 Unchecked Return Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-11-04T09:50:08",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"solutions": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS)",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-10-25T14:00:00.000Z",
"ID": "CVE-2021-34585",
"STATE": "PUBLIC",
"TITLE": "CODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CODESYS V2",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "all web servers",
"version_value": "V1.1.9.22"
}
]
}
}
]
},
"vendor_name": "CODESYS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an invalid address can occur. This leads to a denial of service situation."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-252 Unchecked Return Value"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download=",
"refsource": "CONFIRM",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"name": "https://www.tenable.com/security/research/tra-2021-47",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
]
},
"solution": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-34585",
"datePublished": "2021-10-26T09:55:48.273766Z",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-09-16T21:58:06.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34584 (GCVE-0-2021-34584)
Vulnerability from cvelistv5 – Published: 2021-10-26 09:55 – Updated: 2024-09-16 22:25
VLAI?
Title
CODESYS V2 web server: crafted requests could trigger a buffer over-read (DoS)
Summary
Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
Severity ?
9.1 (Critical)
CWE
- CWE-126 - Buffer Over-read
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V2 |
Affected:
all web servers , < V1.1.9.22
(custom)
|
Credits
This vulnerability was discovered by Tenable Research.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:46.979Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CODESYS V2",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V1.1.9.22",
"status": "affected",
"version": "all web servers",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"datePublic": "2021-10-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-126",
"description": "CWE-126 Buffer Over-read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-28T14:30:20",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"solutions": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CODESYS V2 web server: crafted requests could trigger a buffer over-read (DoS)",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-10-25T14:00:00.000Z",
"ID": "CVE-2021-34584",
"STATE": "PUBLIC",
"TITLE": "CODESYS V2 web server: crafted requests could trigger a buffer over-read (DoS)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CODESYS V2",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "all web servers",
"version_value": "V1.1.9.22"
}
]
}
}
]
},
"vendor_name": "CODESYS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-126 Buffer Over-read"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download=",
"refsource": "CONFIRM",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"name": "https://www.tenable.com/security/research/tra-2021-47",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
]
},
"solution": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-34584",
"datePublished": "2021-10-26T09:55:46.638935Z",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-09-16T22:25:58.664Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34583 (GCVE-0-2021-34583)
Vulnerability from cvelistv5 – Published: 2021-10-26 09:55 – Updated: 2024-09-16 20:43
VLAI?
Title
CODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS)
Summary
Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
Severity ?
7.5 (High)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| CODESYS | CODESYS V2 |
Affected:
all web servers , < V1.1.9.22
(custom)
|
Credits
This vulnerability was discovered by Tenable Research.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:46.979Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CODESYS V2",
"vendor": "CODESYS",
"versions": [
{
"lessThan": "V1.1.9.22",
"status": "affected",
"version": "all web servers",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"datePublic": "2021-10-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-26T19:06:12",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
],
"solutions": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS)",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-10-25T14:00:00.000Z",
"ID": "CVE-2021-34583",
"STATE": "PUBLIC",
"TITLE": "CODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CODESYS V2",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "all web servers",
"version_value": "V1.1.9.22"
}
]
}
}
]
},
"vendor_name": "CODESYS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability was discovered by Tenable Research."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-122 Heap-based Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download=",
"refsource": "CONFIRM",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=16876\u0026token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7\u0026download="
},
{
"name": "https://www.tenable.com/security/research/tra-2021-47",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2021-47"
}
]
},
"solution": [
{
"lang": "en",
"value": "CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-34583",
"datePublished": "2021-10-26T09:55:45.129967Z",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-09-16T20:43:32.357Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}