CVE-2026-8047

Estado: Pendiente de análisisAlta (8.7)—

The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash on the affected device.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 8.7

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.57%
Percentil entre todas las CVEs puntuadas: 46
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %
Impacto principalT1499.004 Application or System Exploitationimpact90 %

Vector CVSS con AV:N/PR:N/UI:N indica explotación remota sin autenticación (T1190). La descripción explícita de 'denial of service via system crash' sostiene T1499.004 (endpoint DoS).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Application Isolation and Sandboxing

CWE

CWE-1284

Referencias

https://www.certvde.com/en/advisories/VDE-2026-057/

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-8047",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-8047",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-26T10:45:06.909963Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control RTE (SL)",
          "versions": [
            {
              "status": "affected",
              "version": "3.5.21.0",
              "lessThan": "3.5.22.20",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control RTE (for Beckhoff CX) SL",
          "versions": [
            {
              "status": "affected",
              "version": "3.5.21.0",
              "lessThan": "3.5.22.20",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control Win (SL)",
          "versions": [
            {
              "status": "affected",
              "version": "3.5.21.0",
              "lessThan": "3.5.22.20",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS HMI (SL)",
          "versions": [
            {
              "status": "affected",
              "version": "3.5.21.0",
              "lessThan": "3.5.22.20",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Runtime Toolkit",
          "versions": [
            {
              "status": "affected",
              "version": "3.5.21.0",
              "lessThan": "3.5.22.20",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for BeagleBone SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.15.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for emPC-A/iMX6 SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.15.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for IOT2000 SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.15.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for Linux ARM SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.15.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for Linux SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.15.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for PFC100 SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.15.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for PFC200 SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.15.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for PLCnext SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.15.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for Raspberry Pi SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.15.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Control for WAGO Touch Panels 600 SL",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "CODESYS",
          "product": "CODESYS Virtual Control SL",
          "versions": [
            {
              "status": "affected",
              "version": "4.15.0.0",
              "lessThan": "4.21.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-05-26T08:16:22.447",
  "references": [
    {
      "url": "https://www.certvde.com/en/advisories/VDE-2026-057/",
      "source": "info@cert.vde.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash on the affected device."
    },
    {
      "lang": "es",
      "value": "Los productos afectados realizan una comprobación de longitud incorrecta al analizar las solicitudes HTTP entrantes, lo que resulta en una escritura fuera de límites de tamaño limitado. Un atacante remoto no autenticado puede explotar esta vulnerabilidad para causar una denegación de servicio mediante un bloqueo del sistema en el dispositivo afectado."
    }
  ],
  "lastModified": "2026-07-23T11:10:00.120",
  "sourceIdentifier": "info@cert.vde.com"
}