« Volver al listado

CVE-2019-9012

Estado: ModificadaAlta (7.5)—

An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products and may result in a denial-of-service condition. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (10)

Codesys — Control FOR Beaglebone SLCodesys — Control FOR Empc-a/imx6 SLCodesys — Control FOR Iot2000 SLCodesys — Control FOR Linux SLCodesys — Control FOR Pfc100 SLCodesys — Control FOR Pfc200 SLCodesys — Control FOR Raspberry PI SLCodesys — Control Runtime ToolkitCodesys — Development SystemCodesys — Gateway

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-9012",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-08-15T18:15:23.477",
  "references": [
    {
      "url": "https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12938&token=b9eb30f53246dc57b2e7cb302356a05547148fa2&download=",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsa-19-213-03",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12938&token=b9eb30f53246dc57b2e7cb302356a05547148fa2&download=",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsa-19-213-03",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products and may result in a denial-of-service condition. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema en los productos 3S-Smart CODESYS V3. Una petición de comunicación diseñada puede causar asignaciones de memoria no controladas en los productos CODESYS afectados y puede resultar en una condición de denegación de servicio. Todas las variantes de los siguientes productos CODESYS V3 en todas las versiones anteriores a v3.5.14.20 que contienen el componente CmpGateway están afectadas, indiferentemente del tipo de CPU o sistema operativo: CODESYS Control para BeagleBone, CODESYS Control para emPC-A/iMX6, CODESYS Control para IOT2000, CODESYS Control para Linux, CODESYS Control para PFC100, CODESYS Control para PFC200, CODESYS Control para Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System."
    }
  ],
  "lastModified": "2026-06-17T02:42:55.230",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4E9C6D8-9CC6-4F07-BF9E-8FBA03198AA0",
              "versionEndExcluding": "3.5.14.20",
              "versionStartIncluding": "3.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:control_for_empc-a\\/imx6_sl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB94C8E2-B642-43D2-9396-46F5AB5E66FC",
              "versionEndExcluding": "3.5.14.20",
              "versionStartIncluding": "3.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6BBF71DD-DCB0-441A-B122-AC9EAD7C1D67",
              "versionEndExcluding": "3.5.14.20",
              "versionStartIncluding": "3.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C50DC2EE-102F-4B47-AF0A-25D2D10FDC1E",
              "versionEndExcluding": "3.5.14.20",
              "versionStartIncluding": "3.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9D5F04F-C033-42E5-A072-137EF5C54DF7",
              "versionEndExcluding": "3.5.14.20",
              "versionStartIncluding": "3.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08E06CDD-4C2A-457B-B456-BB377481C52A",
              "versionEndExcluding": "3.5.14.20",
              "versionStartIncluding": "3.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5424CD6A-42C6-4744-B182-739CC379EA79",
              "versionEndExcluding": "3.5.14.20",
              "versionStartIncluding": "3.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:control_runtime_toolkit:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B19C74A7-08D3-40AC-BF00-87EF5DDA9A0C",
              "versionEndExcluding": "3.5.14.20",
              "versionStartIncluding": "3.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9995DEF-A6ED-4B62-BFE7-F85DF8E56315",
              "versionEndExcluding": "3.5.14.20",
              "versionStartIncluding": "3.0"
            },
            {
              "criteria": "cpe:2.3:a:codesys:gateway:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92CF05A0-31F0-49BB-9299-E9210D954682",
              "versionEndExcluding": "3.5.14.20",
              "versionStartIncluding": "3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}