CVE-2023-37554
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In multiple versions of Codesys products, after successful user authentication, specifically crafted network communication requests with inconsistent content can cause the CmpAppBP component to read from an invalid address, potentially leading to a denial-of-service condition.
Risk Assessment
This vulnerability may lead to service availability interruptions, impacting organizational operations and customer trust.
Recommendation
It is recommended to update Codesys products to the latest versions to mitigate the risks associated with this vulnerability.
Other vulnerabilities in CmpAppBP
See all- CVE-2023-37557Medium
After successful authentication as a user in multiple Codesys products in multiple versions, specifically crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition.
- CVE-2023-37556Medium
In multiple versions of Codesys products, after successful user authentication, specifically crafted network communication requests with inconsistent content can cause the CmpAppBP component to read from an invalid address, potentially leading to a denial-of-service condition.
- CVE-2023-37555Medium
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition.
- CVE-2023-37553Medium
In multiple versions of Codesys products, after successful user authentication, specifically crafted network communication requests with inconsistent content can cause the CmpAppBP component to read from an invalid address, potentially leading to a denial-of-service condition.
- CVE-2023-37552Medium
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition.
Original NVD description (English source)
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37555 and CVE-2023-37556.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS