CVE-2023-37551
Estado: ModificadaMedia (6.5)—
In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Puntuación base: 6.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.50%
- Percentil entre todas las CVEs puntuadas: 41
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (16)
Codesys — Control FOR Beaglebone SLCodesys — Control FOR Empc-a/imx6 SLCodesys — Control FOR Iot2000 SLCodesys — Control FOR Linux SLCodesys — Control FOR Pfc100 SLCodesys — Control FOR Pfc200 SLCodesys — Control FOR Plcnext SLCodesys — Control FOR Raspberry PI SLCodesys — Control FOR Wago Touch Panels 600 SLCodesys — Control RTE SLCodesys — Control RTE SL (for Beckhoff CX)Codesys — Control Runtime System ToolkitCodesys — Control WIN SLCodesys — Development SystemCodesys — HMICodesys — Safety Sil2
CWE
- CWE-552
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-37551",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-37551",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-10-11T18:01:50.770279Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "info@cert.vde.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "info@cert.vde.com",
"affectedData": [
{
"vendor": "CODESYS",
"product": "CODESYS Control for BeagleBone SL",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V4.10.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "CODESYS Control for emPC-A/iMX6 SL",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V4.10.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "CODESYS Control for IOT2000 SL",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V4.10.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "CODESYS Control for Linux SL",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V4.10.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "CODESYS Control for PFC100 SL",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V4.10.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "CODESYS Control for PFC200 SL",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V4.10.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "CODESYS Control for PLCnext SL",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V4.10.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "CODESYS Control for Raspberry Pi SL",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V4.10.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "CODESYS Control for WAGO Touch Panels 600 SL",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V4.10.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "CODESYS Control RTE (for Beckhoff CX) SL",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.5.19.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "CODESYS Control RTE (SL)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.5.19.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "CODESYS Control Runtime System Toolkit",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.5.19.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "CODESYS Control Win (SL)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.5.19.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "CODESYS Development System V3",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.5.19.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "CODESYS HMI (SL)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.5.19.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "CODESYS",
"product": "CODESYS Safety SIL2 Runtime Toolkit",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.5.19.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2023-08-03T12:15:10.257",
"references": [
{
"url": "https://cert.vde.com/en/advisories/VDE-2023-019/",
"tags": [
"Third Party Advisory"
],
"source": "info@cert.vde.com"
},
{
"url": "https://cert.vde.com/en/advisories/VDE-2023-019/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "info@cert.vde.com",
"description": [
{
"lang": "en",
"value": "CWE-552"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller."
},
{
"lang": "es",
"value": "En múltiples productos Codesys en múltiples versiones , después de una autenticación exitosa como usuario, las solicitudes de comunicación de red especialmente diseñadas pueden utilizar el componente CmpApp para descargar archivos con cualquier extensión de archivo al controlador. A diferencia de la descarga de archivos normal a través de CmpFileTransfer, aquí no se realiza ningún filtrado de determinados tipos de archivos. Como resultado, la integridad del sistema de ejecución de control CODESYS puede verse comprometida por los archivos cargados en el controlador."
}
],
"lastModified": "2026-06-17T06:08:26.290",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80D9DB34-C2BD-441F-B8D9-02EFA27BECD8",
"versionEndExcluding": "4.10.0.0"
},
{
"criteria": "cpe:2.3:a:codesys:control_for_empc-a\\/imx6_sl:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "49AA0C0C-F2F2-4F11-9615-FDCA6BC410B4",
"versionEndExcluding": "4.10.0.0"
},
{
"criteria": "cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "74FE662F-5397-4CB7-9243-1E6ED0AAEC29",
"versionEndExcluding": "4.10.0.0"
},
{
"criteria": "cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8896E77C-EB29-4CB9-BC98-D5A34791A961",
"versionEndExcluding": "4.10.0.0"
},
{
"criteria": "cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "56101551-21ED-4409-9932-9EFA225AF20C",
"versionEndExcluding": "4.10.0.0"
},
{
"criteria": "cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C1239AA8-B094-4DA3-82B7-38F85B6C3940",
"versionEndExcluding": "4.10.0.0"
},
{
"criteria": "cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BAA7FE72-41A0-42E7-8E66-9B4A50A5B08F",
"versionEndExcluding": "4.10.0.0"
},
{
"criteria": "cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C248B53C-3C09-4068-9E57-8F9A4D2B7AD0",
"versionEndExcluding": "4.10.0.0"
},
{
"criteria": "cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C7995687-1BCD-454D-8546-52B80B5F22B0",
"versionEndExcluding": "4.10.0.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BAFC253D-32BC-4B9E-BDEE-CFFDCDBBE9FB",
"versionEndExcluding": "3.5.19.20"
},
{
"criteria": "cpe:2.3:a:codesys:control_rte_sl_\\(for_beckhoff_cx\\):*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "297D8781-B331-40B2-BD34-0041A316D5C8",
"versionEndExcluding": "3.5.19.20"
},
{
"criteria": "cpe:2.3:a:codesys:control_runtime_system_toolkit:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DA76230A-C7E7-4223-BAB7-4CDE8F5CB5DB",
"versionEndExcluding": "3.5.19.20"
},
{
"criteria": "cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "09CC9B78-B3B4-4D49-9F23-DC5C80D52588",
"versionEndExcluding": "3.5.19.20"
},
{
"criteria": "cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACDCB65A-1328-422D-99A0-1D0FFE9AC793",
"versionEndExcluding": "3.5.19.20"
},
{
"criteria": "cpe:2.3:a:codesys:hmi:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "81E2FE85-347D-42DE-9360-D5DB79AAD085",
"versionEndExcluding": "3.5.19.20"
},
{
"criteria": "cpe:2.3:a:codesys:safety_sil2:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7DF2418-1EC1-4672-941E-098EBC9BDF4F",
"versionEndExcluding": "3.5.19.20"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "info@cert.vde.com"
}