Riskcovery

CVE-2024-5000

CODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA products

State
Published
Severity
7.5 High
Published
Jun 4, 2024
Updated
Aug 1, 2024
Reserved
May 16, 2024

Read the record on cve.org

Description

An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCERTVDE

Weaknesses

  • CWE-131 Incorrect Calculation of Buffer Size

Affected Products

ProductVersions
CODESYS Control for BeagleBone SLCODESYS
  • before 4.12.0.0Affected
CODESYS Control for emPC-A/iMX6 SLCODESYS
  • before 4.12.0.0Affected
CODESYS Control for IOT2000 SLCODESYS
  • before 4.12.0.0Affected
CODESYS Control for Linux ARM SLCODESYS
  • before 4.12.0.0Affected
CODESYS Control for Linux SLCODESYS
  • before 4.12.0.0Affected
CODESYS Control for PFC100 SLCODESYS
  • before 4.12.0.0Affected
CODESYS Control for PFC200 SLCODESYS
  • before 4.12.0.0Affected
CODESYS Control for PLCnext SLCODESYS
  • before 4.12.0.0Affected
CODESYS Control for Raspberry Pi SLCODESYS
  • before 4.12.0.0Affected
CODESYS Control for WAGO Touch Panels 600 SLCODESYS
  • before 4.12.0.0Affected
CODESYS Control RTE (for Beckhoff CX) SLCODESYS
  • before 3.5.20.10Affected
CODESYS Control RTE (SL)CODESYS
  • before 3.5.20.10Affected
CODESYS Runtime ToolkitCODESYS
  • before 3.5.20.10Affected
CODESYS Control Win (SL)CODESYS
  • before 3.5.20.10Affected
CODESYS HMI (SL)CODESYS
  • before 3.5.20.10Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.