CVE-2023-3669
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A missing Brute-Force protection in CODESYS Development System prior to version 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.
Risk Assessment
The organization is at risk of unauthorized access to the system, which could lead to serious security breaches.
Recommendation
It is recommended to update the CODESYS Development System to version 3.5.19.20 or later to implement proper protection against Brute-Force attacks.
Other vulnerabilities in CODESYS Development System
See all- CVE-2023-3663High
In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.
- CVE-2023-3662High
In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context.
Original NVD description (English source)
A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS