« Volver al listado

CVE-2019-9009

Estado: ModificadaAlta (7.5)—

An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (14)

Codesys — Control FOR BeagleboneCodesys — Control FOR Empc-a/imx6Codesys — Control FOR Iot2000Codesys — Control FOR Pfc100Codesys — Control FOR Pfc200Codesys — Control FOR Raspberry PICodesys — Control RTECodesys — Control WINCodesys — GatewayCodesys — HMICodesys — LinuxCodesys — Runtime System ToolkitCodesys — Safety Sil2Codesys — Simulation Runtime

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-9009",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-09-17T16:15:11.077",
  "references": [
    {
      "url": "https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12941&token=50fabe3870c7bdc41701eb1799dddeec103de40c&download=",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsa-19-255-05",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12941&token=50fabe3870c7bdc41701eb1799dddeec103de40c&download=",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsa-19-255-05",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-755"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en 3S-Smart CODESYS versiones anteriores a 3.5.15.0. Unos paquetes de red diseñados causan que el Control Runtime se bloquee."
    }
  ],
  "lastModified": "2026-06-17T02:42:54.843",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:codesys:control_for_beaglebone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "958821C8-142A-4B67-857B-63A6AD53E1B8",
              "versionEndExcluding": "3.5.15.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:control_for_empc-a\\/imx6:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9940444-8CFD-4044-8662-FDC11E93E6E4",
              "versionEndExcluding": "3.5.15.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:control_for_iot2000:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "805D48DF-DA8F-40AB-B7AE-B2F0A75616E9",
              "versionEndExcluding": "3.5.15.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:control_for_pfc100:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EAEAC81A-4FFA-4692-961D-7DF58E2B0CDE",
              "versionEndExcluding": "3.5.15.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:control_for_pfc200:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2506A775-D1FB-4C2F-98EC-B781AA19E340",
              "versionEndExcluding": "3.5.15.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:control_for_raspberry_pi:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "963C9351-B167-4C1F-914E-A7009A532A0F",
              "versionEndExcluding": "3.5.15.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:control_rte:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A5F978B-5245-41D9-B11C-B27703A2A090",
              "versionEndExcluding": "3.5.15.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:control_win:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1429532E-76A8-4987-B916-AA3FD7C37E06",
              "versionEndExcluding": "3.5.15.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:gateway:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "563FD9B0-D6F5-4A4C-A43D-555C2DC60DD4",
              "versionEndExcluding": "3.5.15.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:hmi:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABFC0D89-BD79-4032-B0CA-08C4F8EA1776",
              "versionEndExcluding": "3.5.15.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:linux:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A2B09D6-8FD2-46FA-A1B2-55B7E996D71B",
              "versionEndExcluding": "3.5.15.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:runtime_system_toolkit:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "417EFF04-1584-44C3-8AD9-593174089A31",
              "versionEndExcluding": "3.5.15.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:safety_sil2:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "139851DD-0E16-4C8D-AA55-0231B2C443A7",
              "versionEndExcluding": "3.5.15.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:simulation_runtime:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3FB11CE8-8B22-4D2D-A0A9-4D23C30A3FF5",
              "versionEndExcluding": "3.5.15.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}