CVE-2023-3663
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious notifications, potentially leading to misinformation or other harmful actions within the system.
Recommendation
It is recommended to update the CODESYS Development System to version 3.5.19.20 or later to mitigate this vulnerability.
Other vulnerabilities in CODESYS Development System
See all- CVE-2023-3669Low
A missing Brute-Force protection in CODESYS Development System prior to version 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.
- CVE-2023-3662High
In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context.
Original NVD description (English source)
In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.