CVE-2023-6357

OS Command Injection in multiple CODESYS products

State: Published
Severity: 8.8 High
Published: Dec 5, 2023
Updated: Aug 2, 2024
Reserved: Nov 28, 2023

Description

A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the device.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
CODESYS Control for BeagleBone SLCODESYS	before 4.11.0.0Affected
CODESYS Control for emPC-A/iMX6 SLCODESYS	before 4.11.0.0Affected
CODESYS Control for IOT2000 SLCODESYS	before 4.11.0.0Affected
CODESYS Control for Linux ARM SLCODESYS	before 4.11.0.0Affected
CODESYS Control for Linux SLCODESYS	before 4.11.0.0Affected
CODESYS Control for PFC100 SLCODESYS	before 4.11.0.0Affected
CODESYS Control for PFC200 SLCODESYS	before 4.11.0.0Affected
CODESYS Control for PLCnext SLCODESYS	before 4.11.0.0Affected
CODESYS Control for Raspberry Pi SLCODESYS	before 4.11.0.0Affected
CODESYS Control for WAGO Touch Panels 600 SLCODESYS	before 4.11.0.0Affected
CODESYS Runtime Toolkit for Linux or QNXCODESYS	before 3.5.19.50Affected

References

https://https//cert.vde.com/en/advisories/VDE-2023-066

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.