vulnwire
7.5high

CVE-2024-5000

CODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA products

Published 2 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 47%
Public exploits
0
none known

An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.

CISA SSVC assessment

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction (EPSS)

0.57% probability of exploitation in the next 30 days, higher than 47% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • CODESYS CODESYS Control for BeagleBone SL
  • CODESYS CODESYS Control for emPC-A/iMX6 SL
  • CODESYS CODESYS Control for IOT2000 SL
  • CODESYS CODESYS Control for Linux ARM SL
  • CODESYS CODESYS Control for Linux SL
  • CODESYS CODESYS Control for PFC100 SL
  • CODESYS CODESYS Control for PFC200 SL
  • CODESYS CODESYS Control for PLCnext SL
  • CODESYS CODESYS Control for Raspberry Pi SL
  • CODESYS CODESYS Control for WAGO Touch Panels 600 SL
  • CODESYS CODESYS Control RTE (for Beckhoff CX) SL
  • CODESYS CODESYS Control RTE (SL)
  • CODESYS CODESYS Runtime Toolkit
  • CODESYS CODESYS Control Win (SL)
  • CODESYS CODESYS HMI (SL)
  • codesys control_for_empc-a\/imx6_sl
  • codesys control_for_beaglebone_sl
  • codesys control_for_iot2000_sl
  • codesys control_for_linux_arm_sl
  • codesys control_for_linux_sl
  • codesys control_for_pfc200_sl
  • codesys control_for_plcnext_sl
  • codesys control_for_raspberry_pi_sl
  • codesys control_for_wago_touch_panels_600_sl
  • codesys control_rte_\(for_beckhoff_cx\)_sl
  • codesys control_rte_\(sl\)
  • codesys control_win_\(sl\)
  • codesys runtime_toolkit
  • codesys hmi_\(sl\)

Classification

Weakness
  • CWE-131 Incorrect Calculation of Buffer Size

References

  • cert.vde.com /en/advisories/VDE-2024-026 · x_transferred
  • customers.codesys.com /index.php?eID=dumpFile&t=f&f=18355&token=e3e5a937ce72602bec39718ddc2f4ba6d983ccd1&downloa · x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.