{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "A Vulnerability in WIBU-SYSTEMS CodeMeter Runtime affects multiple\u00a0Phoenix Contact\u00a0products.\nPhoenix Contact devices using CodeMeter embedded are not affected by\u00a0this\u00a0vulnerability.\nUpdate A, 2023-11-13\nRemoved CVE-2023-4701 because it was revoked.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "An attacker exploiting the vulnerability in WIBU CodeMeter Runtime in server mode could gain full access to the affected server via network access without any user interaction.\nExploiting the vulnerability in WIBU CodeMeter Runtime in non-networked workstation mode could lead to a privilege elevation and full admin access on this workstation.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "1. Use general security best practices to protect systems from local and network attacks like described in the application node AH EN INDUSTRIAL SECURITY.\n\n2. Run CodeMeter as client only and use localhost as binding for the CodeMeter communication. With binding to localhost an attack is no longer possible via remote network connection. The network server is disabled by default. If it is not possible to disable the network server, using a host-based firewall to restrict access to the network for reducing the risk is strongly recommended.\n\n3. The CmWAN server is disabled by default. Please check if CmWAN is enabled and disable the feature if it is not needed.\n\n4. Run the CmWAN server only behind a reverse proxy with user authentication to prevent attacks from unauthenticated users. The risk of an unauthenticated attacker can be further reduced by using a host-based firewall that only allows the reverse proxy to access the CmWAN port.",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "PHOENIX CONTACT strongly recommends affected users to upgrade to CodeMeter V7.60c, which fixes these vulnerabilities. WIBU-SYSTEMS has already published this update for CodeMeter on their homepage. Since this current version of CodeMeter V7.60c has not yet been incorporated into Phoenix Contact products, we strongly recommend to download and install the current CodeMeter version directly from the WIBU-SYSTEMS homepage.\n\nInstall Phoenix Contact Activation Wizard from version 1.7 when available.Please check the Phoenix Contact e-Shop for your related Software product regularly.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@phoenixcontact.com",
      "name": "Phoenix Contact GmbH \u0026 Co. KG",
      "namespace": "https://phoenixcontact.com/psirt"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2023-030: Phoenix Contact: Multiple products affected by WIBU Codemeter Vulnerability (Update A) - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2023-030/"
      },
      {
        "category": "self",
        "summary": "VDE-2023-030: Phoenix Contact: Multiple products affected by WIBU Codemeter Vulnerability (Update A) - CSAF",
        "url": "https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-030.json"
      },
      {
        "category": "external",
        "summary": "Vendor PSIRT",
        "url": "https://phoenixcontact.com/psirt"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Phoenix Contact GmbH \u0026 Co. KG",
        "url": "https://certvde.com/en/advisories/vendor/phoenixcontact/"
      }
    ],
    "title": "Phoenix Contact: Multiple products affected by WIBU Codemeter Vulnerability (Update A)",
    "tracking": {
      "aliases": [
        "VDE-2023-030"
      ],
      "current_release_date": "2023-11-13T11:00:00.000Z",
      "generator": {
        "date": "2025-04-10T09:18:47.042Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.23"
        }
      },
      "id": "VDE-2023-030",
      "initial_release_date": "2023-09-19T06:50:00.000Z",
      "revision_history": [
        {
          "date": "2023-09-19T06:50:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        },
        {
          "date": "2023-11-13T11:00:00.000Z",
          "number": "2",
          "summary": "Update A"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=1.7.0",
                    "product": {
                      "name": "E-Mobility Charging Suite \u003c=1.7.0",
                      "product_id": "CSAFPID-51001",
                      "product_identification_helper": {
                        "model_numbers": [
                          "1153520"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "E-Mobility Charging Suite"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=7.0",
                    "product": {
                      "name": "FL Network Manager \u003c=7.0",
                      "product_id": "CSAFPID-51002",
                      "product_identification_helper": {
                        "model_numbers": [
                          "2702889"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "FL Network Manager"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=1.7.0",
                    "product": {
                      "name": "IOL Conf \u003c=1.7.0",
                      "product_id": "CSAFPID-51003",
                      "product_identification_helper": {
                        "model_numbers": [
                          "1083065"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "IOL Conf"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=1.2.0 BETA",
                    "product": {
                      "name": "MTP DESIGNER \u003c=1.2.0 BETA",
                      "product_id": "CSAFPID-51004",
                      "product_identification_helper": {
                        "model_numbers": [
                          "1636198"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "MTP DESIGNER"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=1.2.0 BETA",
                    "product": {
                      "name": "MTP DESIGNER TRIAL \u003c=1.2.0 BETA",
                      "product_id": "CSAFPID-51005",
                      "product_identification_helper": {
                        "model_numbers": [
                          "1636200"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "MTP DESIGNER TRIAL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=1.6",
                    "product": {
                      "name": "PHOENIX CONTACT Activation Wizard \u003c=1.6",
                      "product_id": "CSAFPID-51006"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "1.7",
                    "product": {
                      "name": "Activation Wizard 1.7",
                      "product_id": "CSAFPID-52002"
                    }
                  }
                ],
                "category": "product_name",
                "name": "PHOENIX CONTACT Activation Wizard"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=1.6",
                    "product": {
                      "name": "PHOENIX CONTACT Activation Wizard in MORYX Software Platform \u003c=1.6",
                      "product_id": "CSAFPID-51007",
                      "product_identification_helper": {
                        "model_numbers": [
                          "1550589"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "1.7",
                    "product": {
                      "name": "PHOENIX CONTACT Activation Wizard in MORYX Software Platform 1.7",
                      "product_id": "CSAFPID-52001",
                      "product_identification_helper": {
                        "model_numbers": [
                          "1550589"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "PHOENIX CONTACT Activation Wizard in MORYX Software Platform"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=2023.6",
                    "product": {
                      "name": "PLCnext Engineer \u003c=2023.6",
                      "product_id": "CSAFPID-51008",
                      "product_identification_helper": {
                        "model_numbers": [
                          "1046008"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "PLCnext Engineer"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=2023.6",
                    "product": {
                      "name": "PLCnext Engineer EDU LIC \u003c=2023.6",
                      "product_id": "CSAFPID-51009",
                      "product_identification_helper": {
                        "model_numbers": [
                          "1165889"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "PLCnext Engineer EDU LIC"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "Phoenix Contact"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005",
          "CSAFPID-51006",
          "CSAFPID-51007",
          "CSAFPID-51008",
          "CSAFPID-51009"
        ],
        "summary": "Affected products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-52001",
          "CSAFPID-52002"
        ],
        "summary": "Fixed products."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-3935",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52001",
          "CSAFPID-52002"
        ],
        "known_affected": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005",
          "CSAFPID-51006",
          "CSAFPID-51007",
          "CSAFPID-51008",
          "CSAFPID-51009"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "1. Use general security best practices to protect systems from local and network attacks like described in the application node AH EN INDUSTRIAL SECURITY.\n\n2. Run CodeMeter as client only and use localhost as binding for the CodeMeter communication. With binding to localhost an attack is no longer possible via remote network connection. The network server is disabled by default. If it is not possible to disable the network server, using a host-based firewall to restrict access to the network for reducing the risk is strongly recommended.\n\n3. The CmWAN server is disabled by default. Please check if CmWAN is enabled and disable the feature if it is not needed.\n\n4. Run the CmWAN server only behind a reverse proxy with user authentication to prevent attacks from unauthenticated users. The risk of an unauthenticated attacker can be further reduced by using a host-based firewall that only allows the reverse proxy to access the CmWAN port.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT strongly recommends affected users to upgrade to CodeMeter V7.60c, which fixes these vulnerabilities. WIBU-SYSTEMS has already published this update for CodeMeter on their homepage. Since this current version of CodeMeter V7.60c has not yet been incorporated into Phoenix Contact products, we strongly recommend to download and install the current CodeMeter version directly from the WIBU-SYSTEMS homepage.\n\nInstall Phoenix Contact Activation Wizard from version 1.7 when available.Please check the Phoenix Contact e-Shop for your related Software product regularly.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001",
            "CSAFPID-51002",
            "CSAFPID-51003",
            "CSAFPID-51004",
            "CSAFPID-51005",
            "CSAFPID-51006",
            "CSAFPID-51007",
            "CSAFPID-51008",
            "CSAFPID-51009"
          ]
        }
      ],
      "title": "CVE-2023-3935"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "The TRUMPF CAD/CAM software tools mentioned above use the vulnerable CodeMeter Runtime (up to version 7.60b) application from WIBU-SYSTEMS AG to manage licenses within the component TRUMPF License Expert. This CodeMeter application contains new vulnerabilities, which may enable an attacker to gain full access to the server or workstation on which the TRUMPF License Expert has been installed on. A new version of the TRUMPF License Expert which fixes this vulnerability is available.Machines with a running and correctly installed mGuard hardware firewall cannot be exploited by this vulnerability if used as intended (according to the manual).\n\nUpdate A, 2023-11-13\nRemoved CVE-2023-4701 because it was revoked.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "An attacker exploiting the vulnerability in WIBU CodeMeter Runtime in server mode could gain full access to the affected server via network access without any user interaction.\nExploiting the vulnerability in WIBU CodeMeter Runtime in non-networked workstation mode could lead to a privilege elevation and full access on this workstation for an already authenticated user (logged in locally to the PC).",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Implement general security best practices like network segmentation, endpoint protection and system hardening.\nRestrict network access to the TRUMPF License Expert server component to required clients only by using firewalls or other suitable products.",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "Get the latest version of the TRUMPF License Expert software (\u003e= V2.0.0)\u00a0at\u00a0trumpf.com/de_DE/produkte/software/software-lizenzierung\u00a0and install it on all affected servers and workstations.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "product.security@trumpf.com",
      "name": "Trumpf SE + Co. KG",
      "namespace": "https://www.trumpf.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2023-031: Trumpf: Multiple Products affected by WIBU Codemeter Vulnerability - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2023-031/"
      },
      {
        "category": "self",
        "summary": "VDE-2023-031: Trumpf: Multiple Products affected by WIBU Codemeter Vulnerability - CSAF",
        "url": "https://trumpf.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-031.json"
      },
      {
        "category": "external",
        "summary": "Vendor PSIRT",
        "url": "https://www.trumpf.com"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Trumpf SE + Co. KG",
        "url": "https://certvde.com/en/advisories/vendor/trumpf/"
      }
    ],
    "title": "Trumpf: Multiple Products affected by WIBU Codemeter Vulnerability",
    "tracking": {
      "aliases": [
        "VDE-2023-031"
      ],
      "current_release_date": "2023-11-13T11:00:00.000Z",
      "generator": {
        "date": "2025-05-14T13:50:48.706Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.25"
        }
      },
      "id": "VDE-2023-031",
      "initial_release_date": "2023-09-13T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2023-09-13T10:00:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        },
        {
          "date": "2023-11-13T11:00:00.000Z",
          "number": "2",
          "summary": "Update A"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "V1.0\u003c=V1.3",
                    "product": {
                      "name": "MonitoringAnalyzer V1.0\u003c=V1.3",
                      "product_id": "CSAFPID-51001"
                    }
                  }
                ],
                "category": "product_name",
                "name": "MonitoringAnalyzer"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "V1.0.0\u003c=V3.0.22",
                    "product": {
                      "name": "Oseon V1.0.0\u003c=V3.0.22",
                      "product_id": "CSAFPID-51002"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Oseon"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "V1.0.1\u003c=V4.6.3",
                    "product": {
                      "name": "ProgrammingTube V1.0.1\u003c=V4.6.3",
                      "product_id": "CSAFPID-51003"
                    }
                  }
                ],
                "category": "product_name",
                "name": "ProgrammingTube"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "V18.02.R8\u003c=V23.06.01",
                    "product": {
                      "name": "TecZoneBend V18.02.R8\u003c=V23.06.01",
                      "product_id": "CSAFPID-51004"
                    }
                  }
                ],
                "category": "product_name",
                "name": "TecZoneBend"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "V14.00\u003c=V22.00.00",
                    "product": {
                      "name": "ToPsCalculation V14.00\u003c=V22.00.00",
                      "product_id": "CSAFPID-51005"
                    }
                  }
                ],
                "category": "product_name",
                "name": "ToPsCalculation"
              },
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "V05.03.00.00",
                    "product": {
                      "name": "Tops Unfold V05.03.00.00",
                      "product_id": "CSAFPID-51006"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Tops Unfold"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "V1.5.2\u003c=V1.11.1",
                    "product": {
                      "name": "TrumpfLicenseExpert V1.5.2\u003c=V1.11.1",
                      "product_id": "CSAFPID-51007"
                    }
                  }
                ],
                "category": "product_name",
                "name": "TrumpfLicenseExpert"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "V08.00\u003c=V12.01.00.00",
                    "product": {
                      "name": "TruTops V08.00\u003c=V12.01.00.00",
                      "product_id": "CSAFPID-51008"
                    }
                  }
                ],
                "category": "product_name",
                "name": "TruTops"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "V06.00.23.00\u003c=V16.0.22",
                    "product": {
                      "name": "TruTopsBoost V06.00.23.00\u003c=V16.0.22",
                      "product_id": "CSAFPID-51009"
                    }
                  }
                ],
                "category": "product_name",
                "name": "TruTopsBoost"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=V09.09.02",
                    "product": {
                      "name": "TruTops Cell Classic \u003c=V09.09.02",
                      "product_id": "CSAFPID-510010"
                    }
                  }
                ],
                "category": "product_name",
                "name": "TruTops Cell Classic"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "V01.00\u003c=V02.26.0",
                    "product": {
                      "name": "TruTops Cell SW48 V01.00\u003c=V02.26.0",
                      "product_id": "CSAFPID-510011"
                    }
                  }
                ],
                "category": "product_name",
                "name": "TruTops Cell SW48"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "V15.00.23.00\u003c=V22.8.25",
                    "product": {
                      "name": "TruTopsFab (inkl.TruTops Monitor) V15.00.23.00\u003c=V22.8.25",
                      "product_id": "CSAFPID-510012"
                    }
                  }
                ],
                "category": "product_name",
                "name": "TruTopsFab (inkl.TruTops Monitor)"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "V14.06.20\u003c=V20.04.20.00",
                    "product": {
                      "name": "TruTopsFab_Storage_SmallStore V14.06.20\u003c=V20.04.20.00",
                      "product_id": "CSAFPID-510013"
                    }
                  }
                ],
                "category": "product_name",
                "name": "TruTopsFab_Storage_SmallStore"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "V01.00\u003c=V06.01",
                    "product": {
                      "name": "TruTops Mark 3D V01.00\u003c=V06.01",
                      "product_id": "CSAFPID-510014"
                    }
                  }
                ],
                "category": "product_name",
                "name": "TruTops Mark 3D"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "V00.06.00\u003c=V01.00",
                    "product": {
                      "name": "TruTopsPrint V00.06.00\u003c=V01.00",
                      "product_id": "CSAFPID-510015"
                    }
                  }
                ],
                "category": "product_name",
                "name": "TruTopsPrint"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003e=V01.02",
                    "product": {
                      "name": "TruTopsPrintMultilaserAssistant \u003e=V01.02",
                      "product_id": "CSAFPID-510016"
                    }
                  }
                ],
                "category": "product_name",
                "name": "TruTopsPrintMultilaserAssistant"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "V7.0.198.241\u003c=V9.0.28148.1",
                    "product": {
                      "name": "TruTopsWeld V7.0.198.241\u003c=V9.0.28148.1",
                      "product_id": "CSAFPID-510017"
                    }
                  }
                ],
                "category": "product_name",
                "name": "TruTopsWeld"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "V08.00\u003c=V14.06.150",
                    "product": {
                      "name": "TubeDesign V08.00\u003c=V14.06.150",
                      "product_id": "CSAFPID-510018"
                    }
                  }
                ],
                "category": "product_name",
                "name": "TubeDesign"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "Trumpf"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005",
          "CSAFPID-51006",
          "CSAFPID-51007",
          "CSAFPID-51008",
          "CSAFPID-51009",
          "CSAFPID-510010",
          "CSAFPID-510011",
          "CSAFPID-510012",
          "CSAFPID-510013",
          "CSAFPID-510014",
          "CSAFPID-510015",
          "CSAFPID-510016",
          "CSAFPID-510017",
          "CSAFPID-510018"
        ],
        "summary": "Affected products."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-3935",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005",
          "CSAFPID-51006",
          "CSAFPID-51007",
          "CSAFPID-51008",
          "CSAFPID-51009",
          "CSAFPID-510010",
          "CSAFPID-510011",
          "CSAFPID-510012",
          "CSAFPID-510013",
          "CSAFPID-510014",
          "CSAFPID-510015",
          "CSAFPID-510016",
          "CSAFPID-510017",
          "CSAFPID-510018"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Implement general security best practices like network segmentation, endpoint protection and system hardening.\nRestrict network access to the TRUMPF License Expert server component to required clients only by using firewalls or other suitable products.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Get the latest version of the TRUMPF License Expert software (\u003e= V2.0.0)\u00a0at\u00a0trumpf.com/de_DE/produkte/software/software-lizenzierung\u00a0and install it on all affected servers and workstations.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001",
            "CSAFPID-51002",
            "CSAFPID-51003",
            "CSAFPID-51004",
            "CSAFPID-51005",
            "CSAFPID-51006",
            "CSAFPID-51007",
            "CSAFPID-51008",
            "CSAFPID-51009",
            "CSAFPID-510010",
            "CSAFPID-510011",
            "CSAFPID-510012",
            "CSAFPID-510013",
            "CSAFPID-510014",
            "CSAFPID-510015",
            "CSAFPID-510016",
            "CSAFPID-510017",
            "CSAFPID-510018"
          ]
        }
      ],
      "title": "CVE-2023-3935"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple Weidmueller products are affected by recent WIBU vulnerability.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "An attacker exploiting the vulnerability in WIBU CodeMeter Runtime in server mode could gain full access to the affected server via network access without any user interaction.\nExploiting the\u00a0vulnerability in WIBU CodeMeter Runtime in non-networked workstation mode could lead to a privilege elevation and full admin access on this workstation.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "u-create studio:\nDisabling the network server function within CodeMeter would mitigate the vulnerability. To disable this function\nplease refer to the following steps:\n\n1. Navigate to the CodeMeter WebAdmin Website\n2. Select option Settings \u003e Server \u003e Server access\n3. Choose option \u0027deactivate\u0027 in section \u0027network server\u0027\n4. Click \u0027Apply\u0027 button on the bottom of the website",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "For the affected **u-control web Controllers** and **IoT-Gateways**, please update the firmware to at least version **2.0.2**.  \nThe firmware update can be obtained from [www.weidmueller.com](https://www.weidmueller.com).\n\nFor **u-create studio**, please update the **CodeMeter control center** software to at least version **7.60c**.  \nThe Codemeter control center is included in u-create studio and is installed on your computer in parallel.  \nThe Codemeter control center update can be obtained from the **WIBU-SYSTEMS** homepage.  \nLook for **\u0027CodeMeter User Runtime f\u00fcr Windows\u0027** on the WIBU website.\n\nFind below appropriate patched firmware versions for all affected products:\n\n| Product Number | Product Name                                      | Patched in Version |\n|----------------|---------------------------------------------------|---------------------|\n| 1334950000     | UC20-WL2000-AC (with u-OS)                        |  2.0.2             |\n| 1334990000     | UC20-WL2000-IOT (with u-OS)                       |  2.0.2             |\n| 2682620000     | IOT-GW30 (with u-OS)                              |  2.0.2             |\n| 2682630000     | IOT-GW30-4G-EU (with u-OS)                        |  2.0.2             |\n| 2660130000     | u-create studio with CodeMeter control center    |  7.60c             |",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@weidmueller.com",
      "name": "Weidmueller Interface GmbH \u0026 Co. KG",
      "namespace": "https://www.weidmueller.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2023-032: Weidmueller: WIBU Vulnerability in multiple Products - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2023-032/"
      },
      {
        "category": "self",
        "summary": "VDE-2023-032: Weidmueller: WIBU Vulnerability in multiple Products - CSAF",
        "url": "https://weidmueller.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-032.json"
      },
      {
        "category": "external",
        "summary": "Weidmueller PSIRT",
        "url": "https://www.weidmueller.com/int/solutions/solutions/industrial_security/index.jsp"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Weidmueller Interface GmbH \u0026 Co. KG",
        "url": "https://certvde.com/en/advisories/vendor/weidmueller/"
      }
    ],
    "title": "Weidmueller: WIBU Vulnerability in multiple Products",
    "tracking": {
      "aliases": [
        "VDE-2023-032"
      ],
      "current_release_date": "2025-05-22T13:03:10.000Z",
      "generator": {
        "date": "2025-05-05T12:10:06.840Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.24"
        }
      },
      "id": "VDE-2023-032",
      "initial_release_date": "2023-11-09T07:42:00.000Z",
      "revision_history": [
        {
          "date": "2023-11-09T07:42:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        },
        {
          "date": "2025-05-22T13:03:10.000Z",
          "number": "2",
          "summary": "Fix: quotation mark"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "2.0.0",
                    "product": {
                      "name": "IOT-GW30-4G-EU (with u-OS) 2.0.0",
                      "product_id": "CSAFPID-51001",
                      "product_identification_helper": {
                        "model_numbers": [
                          "2682630000"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.0.1",
                    "product": {
                      "name": "IOT-GW30-4G-EU (with u-OS) 2.0.1",
                      "product_id": "CSAFPID-51002",
                      "product_identification_helper": {
                        "model_numbers": [
                          "2682630000"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.0.2",
                    "product": {
                      "name": "IOT-GW30-4G-EU (with u-OS) 2.0.2",
                      "product_id": "CSAFPID-52001"
                    }
                  }
                ],
                "category": "product_name",
                "name": "IOT-GW30-4G-EU (with u-OS)"
              },
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "2.0.0",
                    "product": {
                      "name": "IOT-GW30 (with u-OS) 2.0.0",
                      "product_id": "CSAFPID-51003",
                      "product_identification_helper": {
                        "model_numbers": [
                          "2682620000"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.0.1",
                    "product": {
                      "name": "IOT-GW30 (with u-OS) 2.0.2",
                      "product_id": "CSAFPID-51004",
                      "product_identification_helper": {
                        "model_numbers": [
                          "2682620000"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.0.2",
                    "product": {
                      "name": "IOT-GW30 (with u-OS) 2.0.2",
                      "product_id": "CSAFPID-52002"
                    }
                  }
                ],
                "category": "product_name",
                "name": "IOT-GW30 (with u-OS)"
              },
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "2.0.0",
                    "product": {
                      "name": "UC20-WL2000-AC (with u-OS) 2.0.0",
                      "product_id": "CSAFPID-51005",
                      "product_identification_helper": {
                        "model_numbers": [
                          "1334950000"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.0.1",
                    "product": {
                      "name": "UC20-WL2000-AC (with u-OS) 2.0.1",
                      "product_id": "CSAFPID-51006",
                      "product_identification_helper": {
                        "model_numbers": [
                          "1334950000"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.0.2",
                    "product": {
                      "name": "UC20-WL2000-AC (with u-OS) 2.0.2",
                      "product_id": "CSAFPID-52003"
                    }
                  }
                ],
                "category": "product_name",
                "name": "UC20-WL2000-AC (with u-OS)"
              },
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "2.0.0",
                    "product": {
                      "name": "UC20-WL2000-IOT (with u-OS) 2.0.0",
                      "product_id": "CSAFPID-51007",
                      "product_identification_helper": {
                        "model_numbers": [
                          "1334990000"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.0.1",
                    "product": {
                      "name": "UC20-WL2000-IOT (with u-OS) 2.0.1",
                      "product_id": "CSAFPID-51008",
                      "product_identification_helper": {
                        "model_numbers": [
                          "1334990000"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.0.2",
                    "product": {
                      "name": "UC20-WL2000-IOT (with u-OS) 2.0.2",
                      "product_id": "CSAFPID-52004"
                    }
                  }
                ],
                "category": "product_name",
                "name": "UC20-WL2000-IOT (with u-OS)"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=4.2.4",
                    "product": {
                      "name": "u-create studio \u003c= 4.2.4",
                      "product_id": "CSAFPID-51009",
                      "product_identification_helper": {
                        "model_numbers": [
                          "2660130000"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "7.60c",
                    "product": {
                      "name": "u-create studio 7.60c",
                      "product_id": "CSAFPID-52005",
                      "product_identification_helper": {
                        "model_numbers": [
                          "2660130000"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "u-create studio"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "Weidm\u00fcller"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005",
          "CSAFPID-51006",
          "CSAFPID-51007",
          "CSAFPID-51008",
          "CSAFPID-51009"
        ],
        "summary": "Affected products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-52001",
          "CSAFPID-52002",
          "CSAFPID-52003",
          "CSAFPID-52004",
          "CSAFPID-52005"
        ],
        "summary": "Fixed products."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-3935",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52001",
          "CSAFPID-52002",
          "CSAFPID-52003",
          "CSAFPID-52004",
          "CSAFPID-52005"
        ],
        "known_affected": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005",
          "CSAFPID-51006",
          "CSAFPID-51007",
          "CSAFPID-51008",
          "CSAFPID-51009"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "u-create studio:\nDisabling the network server function within CodeMeter would mitigate the vulnerability. To disable this function\nplease refer to the following steps:\n\n1. Navigate to the CodeMeter WebAdmin Website\n2. Select option Settings \u003e Server \u003e Server access\n3. Choose option \u0027deactivate\u0027 in section \u0027network server\u0027\n4. Click \u0027Apply\u0027 button on the bottom of the website",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "For the affected **u-control web Controllers** and **IoT-Gateways**, please update the firmware to at least version **2.0.2**.  \nThe firmware update can be obtained from [www.weidmueller.com](https://www.weidmueller.com).\n\nFor **u-create studio**, please update the **CodeMeter control center** software to at least version **7.60c**.  \nThe Codemeter control center is included in u-create studio and is installed on your computer in parallel.  \nThe Codemeter control center update can be obtained from the **WIBU-SYSTEMS** homepage.  \nLook for **\u0027CodeMeter User Runtime f\u00fcr Windows\u0027** on the WIBU website.\n\nFind below appropriate patched firmware versions for all affected products:\n\n| Product Number | Product Name                                      | Patched in Version |\n|----------------|---------------------------------------------------|---------------------|\n| 1334950000     | UC20-WL2000-AC (with u-OS)                        |  2.0.2             |\n| 1334990000     | UC20-WL2000-IOT (with u-OS)                       |  2.0.2             |\n| 2682620000     | IOT-GW30 (with u-OS)                              |  2.0.2             |\n| 2682630000     | IOT-GW30-4G-EU (with u-OS)                        |  2.0.2             |\n| 2660130000     | u-create studio with CodeMeter control center    |  7.60c             |",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001",
            "CSAFPID-51002",
            "CSAFPID-51003",
            "CSAFPID-51004",
            "CSAFPID-51005",
            "CSAFPID-51006",
            "CSAFPID-51007",
            "CSAFPID-51008",
            "CSAFPID-51009"
          ]
        }
      ],
      "title": "CVE-2023-3935"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Several Pilz products use the 3rd party component \"CodeMeter Runtime\" from WIBU-SYSTEM AG to manage software licenses. This component is affected by a vulnerability, which may enable an attacker to gain full control over the system running the software product. The vulnerability can be exploited locally or over the network.\n\nUpdate A, 2023-12-05\n\nchanged affected version of \"Software PASvisu \u003c 1.15.0\" to \"Software PASvisu \u003c 1.14.1\"\nremoved CVE-2023-4701 because it was revoked.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "When running WIBU CodeMeter Runtime in non-server mode, a local user may grant themselves improper elevated privileges. When running in server mode, a remote attacker may gain full control over the system. By default, the CodeMeter Runtime is running in non-server mode.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "PAS4000, PASvisu, PIT User Authentication Service, PNOZsigma Configurator, PMIv8: Installthe fixed version as soon as it is available. Please visit the Pilz eShop(https://www.pilz.com/en-INT/eshop) to check for the fixed version.\nPASloto, Live Video Server, SafetyEYE Configurator, PMC programming tool: These productsare end-of-live, please follow the general countermeasures.",
        "title": "Remediation"
      },
      {
        "category": "general",
        "text": "- Download and install CodeMeter Runtime version 7.60c or later from WIBU-SYSTEM\u0027s website https://www.wibu.com/de/support.html\n\n- When CodeMeter Runtime is used in server mode, restrict access on the network-level by using a firewall or comparable measures.\n\n- Restrict local access to authorized users only on the system running the CodeMeter runtime.\n\n- Also deploy strong hardening measures and endpoint protection solutions.",
        "title": "General Countermeasures"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@pilz.com",
      "name": "Pilz GmbH \u0026 Co. KG",
      "namespace": "https://www.pilz.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2023-033: Pilz: WIBU Vulnerabilitiy in multiple Products - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2023-033/"
      },
      {
        "category": "self",
        "summary": "VDE-2023-033: Pilz: WIBU Vulnerabilitiy in multiple Products - CSAF",
        "url": "https://pilz.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-033.json"
      },
      {
        "category": "external",
        "summary": "Pilz PSIRT",
        "url": "https://www.pilz.com/en-INT/products/industrial-security/security-incident-management"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Pilz GmbH \u0026 Co. KG",
        "url": "https://certvde.com/en/advisories/vendor/pilz/"
      }
    ],
    "title": "Pilz: WIBU Vulnerabilitiy in multiple Products",
    "tracking": {
      "aliases": [
        "VDE-2023-033"
      ],
      "current_release_date": "2025-05-22T13:03:10.000Z",
      "generator": {
        "date": "2025-05-05T12:05:40.075Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.24"
        }
      },
      "id": "VDE-2023-033",
      "initial_release_date": "2023-10-12T06:00:00.000Z",
      "revision_history": [
        {
          "date": "2023-10-12T06:00:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        },
        {
          "date": "2023-12-05T11:00:00.000Z",
          "number": "2",
          "summary": "Update A"
        },
        {
          "date": "2025-05-22T13:03:10.000Z",
          "number": "3",
          "summary": "Fix: quotation mark"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=1.1.3",
                    "product": {
                      "name": "PASloto \u003c= 1.1.3",
                      "product_id": "CSAFPID-51001"
                    }
                  }
                ],
                "category": "product_name",
                "name": "PASloto"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "3.0.0\u003c=3.5.18.2",
                    "product": {
                      "name": "PMC programming tool 3.x.x 3.0.0 \u003c= 3.5.18.2",
                      "product_id": "CSAFPID-51002"
                    }
                  }
                ],
                "category": "product_name",
                "name": "PMC programming tool 3.x.x"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=2.0.33992",
                    "product": {
                      "name": "PMI v8xx \u003c= 2.0.33992",
                      "product_id": "CSAFPID-51003",
                      "product_identification_helper": {
                        "model_numbers": [
                          "266807, 266812, 266815"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "PMI v8xx"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c1.5.0",
                    "product": {
                      "name": "PNOZsigma Configurator \u003c 1.5.0",
                      "product_id": "CSAFPID-51004"
                    }
                  }
                ],
                "category": "product_name",
                "name": "PNOZsigma Configurator"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=1.1.0",
                    "product": {
                      "name": "Software Live Video Server \u003c= 1.1.0",
                      "product_id": "CSAFPID-51005"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Software Live Video Server"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c1.26.0",
                    "product": {
                      "name": "Software PAS4000 \u003c 1.26.0",
                      "product_id": "CSAFPID-51006"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Software PAS4000"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c1.14.1",
                    "product": {
                      "name": "Software PASvisu \u003c 1.14.1",
                      "product_id": "CSAFPID-51007"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Software PASvisu"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c1.1.2",
                    "product": {
                      "name": "Software PIT User Authentication Service \u003c 1.1.2",
                      "product_id": "CSAFPID-51008"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Software PIT User Authentication Service"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "3.0.0\u003c=3.0.1",
                    "product": {
                      "name": "Software SafetyEYE Configurator 3.0.0\u003c= 3.0.1",
                      "product_id": "CSAFPID-51009"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Software SafetyEYE Configurator"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "Pilz"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005",
          "CSAFPID-51006",
          "CSAFPID-51007",
          "CSAFPID-51008",
          "CSAFPID-51009"
        ],
        "summary": "Affected products."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-3935",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005",
          "CSAFPID-51006",
          "CSAFPID-51007",
          "CSAFPID-51008",
          "CSAFPID-51009"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "PAS4000, PASvisu, PIT User Authentication Service, PNOZsigma Configurator, PMIv8: Installthe fixed version as soon as it is available. Please visit the Pilz eShop(https://www.pilz.com/en-INT/eshop) to check for the fixed version.\nPASloto, Live Video Server, SafetyEYE Configurator, PMC programming tool: These productsare end-of-live, please follow the general countermeasures.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001",
            "CSAFPID-51002",
            "CSAFPID-51003",
            "CSAFPID-51004",
            "CSAFPID-51005",
            "CSAFPID-51006",
            "CSAFPID-51007",
            "CSAFPID-51008",
            "CSAFPID-51009"
          ]
        }
      ],
      "title": "CVE-2023-3935"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Several CODESYS setups contain and install vulnerable versions of the WIBU CodeMeter Runtime.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "The CODESYS Development System is an IEC 61131-3 programming tool for PLCs based on the CODESYSControl runtime system, which enables embedded or PC-based devices to be a programmable industrialcontroller. All affected CODESYS products install and use the WIBU CodeMeter Runtime for licensemanagement. The manufacturer WIBU-SYSTEMS AG has reported a heap buffer overflow vulnerability in theWIBU CodeMeter Runtime, which can potentially lead to a remote code execution.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "WIBU-SYSTEMS AG recommends updating to CodeMeter Runtime version 7.60c to fix the vulnerability.\n\nUntil an update is available for the affected CODESYS products or if this is not to be installed, CODESYS\nGmbH recommends downloading and installing the current CodeMeter Runtime directly from the website of\nWIBU-SYSTEMS AG (https://www.wibu.com/support/user/user-software.html).\n\nIf neither an update of the affected CODESYS products nor an update of the WIBU CodeMeter Runtime can be performed, you may find further mitigations in the Security Advisory WIBU-230704-01 provided by WIBUSYSTEMS AG (https://www.wibu.com/support/security-advisories.html).",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "Update the following products to version 3.5.19.30.\n\n\u2022 CODESYS Control RTE (SL)\n\n\u2022 CODESYS Control RTE (for Beckhoff CX) SL\n\n\u2022 CODESYS Control Win (SL)\n\n\u2022 CODESYS HMI (SL)\n\n\u2022 CODESYS Development System \n\n\u2022 CODESYS OPC DA Server SL\n\nUpdate the following products to version to 4.10.0.0.\n\n\u2022 CODESYS Control for Linux SL\n\n\u2022 CODESYS Control\u00a0for Linux ARM SL\n\nFor the legacy CODESYS V2 products, no new version is scheduled.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@codesys.com",
      "name": "CODESYS GmbH",
      "namespace": "https://www.codesys.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2023-035: CODESYS: Multiple products affected by WIBU Codemeter vulnerability - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2023-035/"
      },
      {
        "category": "self",
        "summary": "VDE-2023-035: CODESYS: Multiple products affected by WIBU Codemeter vulnerability - CSAF",
        "url": "https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-035.json"
      },
      {
        "category": "external",
        "summary": "Vendor PSIRT",
        "url": "https://www.codesys.com"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for CODESYS GmbH",
        "url": "https://certvde.com/en/advisories/vendor/codesys/"
      }
    ],
    "title": "CODESYS: Multiple products affected by WIBU Codemeter vulnerability",
    "tracking": {
      "aliases": [
        "VDE-2023-035"
      ],
      "current_release_date": "2023-12-05T07:00:00.000Z",
      "generator": {
        "date": "2025-04-23T08:34:15.959Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.23"
        }
      },
      "id": "VDE-2023-035",
      "initial_release_date": "2023-12-05T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2023-12-05T07:00:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c4.10.0.0",
                    "product": {
                      "name": "CODESYS Control for Linux ARM SL \u003c4.10.0.0",
                      "product_id": "CSAFPID-51001"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "4.10.0.0",
                    "product": {
                      "name": "CODESYS Control for Linux ARM SL 4.10.0.0",
                      "product_id": "CSAFPID-52001"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control for Linux ARM SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c4.10.0.0",
                    "product": {
                      "name": "CODESYS Control for Linux SL \u003c4.10.0.0",
                      "product_id": "CSAFPID-51002"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "4.10.0.0",
                    "product": {
                      "name": "CODESYS Control for Linux SL 4.10.0.0",
                      "product_id": "CSAFPID-52002"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control for Linux SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c3.5.19.30",
                    "product": {
                      "name": "CODESYS Control RTE (for Beckhoff CX) SL \u003c3.5.19.30",
                      "product_id": "CSAFPID-51003"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.5.19.30",
                    "product": {
                      "name": "CODESYS Control RTE (for Beckhoff CX) SL 3.5.19.30",
                      "product_id": "CSAFPID-52003"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control RTE (for Beckhoff CX) SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c3.5.19.30",
                    "product": {
                      "name": "CODESYS Control RTE (SL) \u003c3.5.19.30",
                      "product_id": "CSAFPID-51004"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.5.19.30",
                    "product": {
                      "name": "CODESYS Control RTE (SL) 3.5.19.30",
                      "product_id": "CSAFPID-52004"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control RTE (SL)"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c3.5.19.30",
                    "product": {
                      "name": "CODESYS Control Win (SL) \u003c3.5.19.30",
                      "product_id": "CSAFPID-51005"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.5.19.30",
                    "product": {
                      "name": "CODESYS Control Win (SL) 3.5.19.30",
                      "product_id": "CSAFPID-52005"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control Win (SL)"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "2.3.9.45\u003c3.5.19.30",
                    "product": {
                      "name": "CODESYS Software CODESYS Development System 2.3.9.45\u003c3.5.19.30",
                      "product_id": "CSAFPID-51006"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.5.19.30",
                    "product": {
                      "name": "CODESYS Development System 3.5.19.30",
                      "product_id": "CSAFPID-52006"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Development System"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c3.5.19.30",
                    "product": {
                      "name": "CODESYS HMI (SL) \u003c3.5.19.30",
                      "product_id": "CSAFPID-51007"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.5.19.30",
                    "product": {
                      "name": "CODESYS HMI (SL) 3.5.19.30",
                      "product_id": "CSAFPID-52007"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS HMI (SL)"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c3.5.19.30",
                    "product": {
                      "name": "CODESYS OPC OA Server SL \u003c3.5.19.30",
                      "product_id": "CSAFPID-51008"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.5.19.30",
                    "product": {
                      "name": "CODESYS OPC OA Server SL 3.5.19.30",
                      "product_id": "CSAFPID-52008"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS OPC OA Server SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003e=2.3.7.25",
                    "product": {
                      "name": "CODESYS SP Realtime NT \u003e=2.3.7.25",
                      "product_id": "CSAFPID-51009"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS SP Realtime NT"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "CODESYS"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005",
          "CSAFPID-51006",
          "CSAFPID-51007",
          "CSAFPID-51008",
          "CSAFPID-51009"
        ],
        "summary": "Affected products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-52001",
          "CSAFPID-52002",
          "CSAFPID-52003",
          "CSAFPID-52004",
          "CSAFPID-52005",
          "CSAFPID-52006",
          "CSAFPID-52007",
          "CSAFPID-52008"
        ],
        "summary": "Fixed products."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-3935",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52001",
          "CSAFPID-52002",
          "CSAFPID-52003",
          "CSAFPID-52004",
          "CSAFPID-52005",
          "CSAFPID-52006",
          "CSAFPID-52007",
          "CSAFPID-52008"
        ],
        "known_affected": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005",
          "CSAFPID-51006",
          "CSAFPID-51007",
          "CSAFPID-51008",
          "CSAFPID-51009"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "WIBU-SYSTEMS AG recommends updating to CodeMeter Runtime version 7.60c to fix the vulnerability.\n\nUntil an update is available for the affected CODESYS products or if this is not to be installed, CODESYS\nGmbH recommends downloading and installing the current CodeMeter Runtime directly from the website of\nWIBU-SYSTEMS AG (https://www.wibu.com/support/user/user-software.html).\n\nIf neither an update of the affected CODESYS products nor an update of the WIBU CodeMeter Runtime can be performed, you may find further mitigations in the Security Advisory WIBU-230704-01 provided by WIBUSYSTEMS AG (https://www.wibu.com/support/security-advisories.html).",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update the following products to version 3.5.19.30.\n\n\u2022 CODESYS Control RTE (SL)\n\n\u2022 CODESYS Control RTE (for Beckhoff CX) SL\n\n\u2022 CODESYS Control Win (SL)\n\n\u2022 CODESYS HMI (SL)\n\n\u2022 CODESYS Development System \n\n\u2022 CODESYS OPC DA Server SL\n\nUpdate the following products to version to 4.10.0.0.\n\n\u2022 CODESYS Control for Linux SL\n\n\u2022 CODESYS Control\u00a0for Linux ARM SL\n\nFor the legacy CODESYS V2 products, no new version is scheduled.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001",
            "CSAFPID-51002",
            "CSAFPID-51003",
            "CSAFPID-51004",
            "CSAFPID-51005",
            "CSAFPID-51006",
            "CSAFPID-51007",
            "CSAFPID-51008",
            "CSAFPID-51009"
          ]
        }
      ],
      "title": "CVE-2023-3935"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Critical vulnerability has been discovered in the utilized component PROFINET IO Device by Hilscher Gesellschaft f\u00fcr Systemautomation mbH.\nThe impact of the vulnerability on the affected device is that it can\n\nno longer perform acyclic requests\nmay drop all established cyclic connections may\ndisappear completely from the network\nFor more information see advisory by Hilscher:\n\nhttps://kb.hilscher.com/display/ISMS/2020-12-03+Denial+of+Service+vulnerability+in+PROFINET+IO+Device\n\nUpdate 20.11.2024: Products have been added",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "WAGO controllers and IO-Devices are not affected by WIBU-SYSTEMS Codemeter vulnerabilities. However, due to compatibility reasons to the CODESYS Store, the e!COCKPIT and engineering software is bundled with a WIBU-SYSTEMS Codemeter installation.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Use general security best practices to protect systems from local and network attacks.\n\nFor further details on risk mitigation and impact of this vulnerability, please refer to the official WIBU-SYSTEMS Product Security Advisory WIBU-230704-01 at Website https://www.wibu.com/support/security-advisories.html.",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "Until an update is available for e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) we strongly encourage users to update WIBU-SYSTEMS Codemeter by installing the latest available stand-alone WIBU-SYSTEMS Codemeter Version. (https://www.wibu.com/support/user/user-software.html).",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@wago.com",
      "name": "WAGO GmbH \u0026 Co. KG",
      "namespace": "https://www.wago.com/psirt"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2023-042: Wago: Vulnerable WIBU-SYSTEMS Codemeter installed through e!COCKPIT and WAGO-I/O-Pro (UPDATE B) - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2023-042/"
      },
      {
        "category": "self",
        "summary": "VDE-2023-042: Wago: Vulnerable WIBU-SYSTEMS Codemeter installed through e!COCKPIT and WAGO-I/O-Pro (UPDATE B) - CSAF",
        "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-042.json"
      },
      {
        "category": "external",
        "summary": "Vendor PSIRT",
        "url": "https://www.wago.com/psirt"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for WAGO GmbH \u0026 Co. KG",
        "url": "https://certvde.com/en/advisories/vendor/wago/"
      }
    ],
    "title": "Wago: Vulnerable WIBU-SYSTEMS Codemeter installed through e!COCKPIT and WAGO-I/O-Pro (UPDATE B)",
    "tracking": {
      "aliases": [
        "VDE-2023-042"
      ],
      "current_release_date": "2024-11-20T11:00:00.000Z",
      "generator": {
        "date": "2025-05-05T08:18:40.876Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.24"
        }
      },
      "id": "VDE-2023-042",
      "initial_release_date": "2023-09-25T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2023-09-25T10:00:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        },
        {
          "date": "2024-11-20T11:00:00.000Z",
          "number": "2",
          "summary": "Update A"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=1.11.2.0",
                    "product": {
                      "name": "e!COCKPIT engineering software installation bundle \u003c=1.11.2.0",
                      "product_id": "CSAFPID-51001"
                    }
                  }
                ],
                "category": "product_name",
                "name": "e!COCKPIT engineering software installation bundle"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "2.3.9.45\u003c=2.3.9.70",
                    "product": {
                      "name": "WAGO-I/O-Pro (CODESYS 2.3) engineering software installation 2.3.9.45\u003c=2.3.9.70",
                      "product_id": "CSAFPID-51002"
                    }
                  }
                ],
                "category": "product_name",
                "name": "WAGO-I/O-Pro (CODESYS 2.3) engineering software installation"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "Wago"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-51001",
          "CSAFPID-51002"
        ],
        "summary": "Affected products."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-3935",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-51001",
          "CSAFPID-51002"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Use general security best practices to protect systems from local and network attacks.\n\nFor further details on risk mitigation and impact of this vulnerability, please refer to the official WIBU-SYSTEMS Product Security Advisory WIBU-230704-01 at Website https://www.wibu.com/support/security-advisories.html.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Until an update is available for e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) we strongly encourage users to update WIBU-SYSTEMS Codemeter by installing the latest available stand-alone WIBU-SYSTEMS Codemeter Version. (https://www.wibu.com/support/user/user-software.html).",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001",
            "CSAFPID-51002"
          ]
        }
      ],
      "title": "CVE-2023-3935"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "A vulnerability in Wibu-Systems CodeMeter (up to version 7.60b) affects multiple Endress+Hauser products. This flaw can lead to a heap buffer overflow, which may allow remote code execution under certain conditions.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "An attacker exploiting the vulnerability in Wibu CodeMeter Runtime when running in server mode could gain full control of the affected server via network access without any user interaction. In non-networked workstation mode, exploiting the same vulnerability could result in privilege escalation, granting the attacker full administrative access to the workstation. ",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "If possible, configure CodeMeter to run in client-only mode. If server mode is required, restrict access to authorized clients by implementing an access control list. \nFor Proline Promag 800 OPC UA Connectivity, CodeMeter operates as a server only during license activation. Installation and license activation are managed by Endress+Hauser. If a customer performs manual license activation, it is strongly recommended to limit network access to necessary clients only by using firewalls or equivalent security measures. ",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "Endress+Hauser has released updated firmware versions that address this vulnerability. The only exception is Proline Promag 800 OPC UA Connectivity, with the update planned for Q3 2026. Customers are strongly advised to upgrade to the latest fixed version. For assistance, please contact your local Endress+Hauser service center.\n\n| Product                          | Fixed Version |\n|----------------------------------|---------------|\n| DeviceCare               | 1.07.05       |\n| FDM installations              | 1.6.13.10138     |\n| FieldCare            | 2.16.00       |\n| SupplyCare Enterprise           | 3.14      |",
        "title": "Remediation"
      },
      {
        "category": "general",
        "text": "Endress+Hauser recommends operating these solutions in a secure environment and restricting access to components to authorized personnel only. ",
        "title": "General Recommendation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@endress.com",
      "name": "Endress+Hauser AG",
      "namespace": "https://www.endress.com"
    },
    "references": [
      {
        "category": "external",
        "summary": "Endress+Hauser",
        "url": "https://www.endress.com"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Endress+Hauser",
        "url": "https://certvde.com/en/advisories/vendor/endress+hauser"
      },
      {
        "category": "self",
        "summary": "VDE-2025-105: Endress+Hauser: Multiple products affected by Wibu-Systems CodeMeter Vulnerability - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2025-105"
      },
      {
        "category": "self",
        "summary": "VDE-2025-105: Endress+Hauser: Multiple products affected by Wibu-Systems CodeMeter Vulnerability - CSAF",
        "url": "https://endress-hauser.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-105.json"
      }
    ],
    "title": "Endress+Hauser: Multiple products affected by Wibu-Systems CodeMeter Vulnerability",
    "tracking": {
      "aliases": [
        "VDE-2025-105"
      ],
      "current_release_date": "2025-12-08T09:00:00.000Z",
      "generator": {
        "date": "2025-12-02T12:54:30.507Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.40"
        }
      },
      "id": "VDE-2025-105",
      "initial_release_date": "2025-12-08T09:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-12-08T09:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c1.07.05",
                    "product": {
                      "name": "DeviceCare \u003c1.07.05",
                      "product_id": "CSAFPID-51001"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "1.07.05",
                    "product": {
                      "name": "DeviceCare 1.07.05",
                      "product_id": "CSAFPID-52001"
                    }
                  }
                ],
                "category": "product_name",
                "name": "DeviceCare "
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c1.6.13.10138",
                    "product": {
                      "name": "FDM installations \u003c1.6.13.10138",
                      "product_id": "CSAFPID-51002"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "1.6.13.10138",
                    "product": {
                      "name": "FDM installations 1.6.13.10138",
                      "product_id": "CSAFPID-52002"
                    }
                  }
                ],
                "category": "product_name",
                "name": "FDM installations "
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c2.16.00",
                    "product": {
                      "name": "FieldCare \u003c2.16.00",
                      "product_id": "CSAFPID-51003"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.16.00",
                    "product": {
                      "name": "FieldCare 2.16.00",
                      "product_id": "CSAFPID-52003"
                    }
                  }
                ],
                "category": "product_name",
                "name": "FieldCare "
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c3.14",
                    "product": {
                      "name": "SupplyCare Enterprise  \u003c3.14",
                      "product_id": "CSAFPID-51004"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.14 ",
                    "product": {
                      "name": "SupplyCare Enterprise  3.14",
                      "product_id": "CSAFPID-52004"
                    }
                  }
                ],
                "category": "product_name",
                "name": "SupplyCare Enterprise  "
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "Proline Promag 800 OPC UA Connectivity vers:all/* ",
                      "product_id": "CSAFPID-51005"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Proline Promag 800 OPC UA Connectivity "
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "Endress+Hauser"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005"
        ],
        "summary": "Affected products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-52001",
          "CSAFPID-52002",
          "CSAFPID-52003",
          "CSAFPID-52004"
        ],
        "summary": "Fixed products."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-3935",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system. ",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52001",
          "CSAFPID-52002",
          "CSAFPID-52003",
          "CSAFPID-52004"
        ],
        "known_affected": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "If possible, configure CodeMeter to run in client-only mode. If server mode is required, restrict access to authorized clients by implementing an access control list. \nFor Proline Promag 800 OPC UA Connectivity, CodeMeter operates as a server only during license activation. Installation and license activation are managed by Endress+Hauser. If a customer performs manual license activation, it is strongly recommended to limit network access to necessary clients only by using firewalls or equivalent security measures. ",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Endress+Hauser has released updated firmware versions that address this vulnerability. Customers are strongly advised to upgrade to the latest fixed version. For assistance, please contact your local Endress+Hauser service center. ",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001",
            "CSAFPID-51002",
            "CSAFPID-51003",
            "CSAFPID-51004",
            "CSAFPID-51005"
          ]
        }
      ],
      "title": "Wibu: Buffer Overflow in CodeMeter Runtime"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "CodeMeter ist eine Software zur Durchsetzung von Lizenzrechten.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter anonymer Angreifer kann eine Schwachstelle in Wibu-Systems CodeMeter ausnutzen, um beliebigen Code auszuf\u00fchren oder seine Privilegien zu erweitern.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- Windows\n- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-2311 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2311.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-2311 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2311"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory SSA-240541 vom 2023-09-12",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-240541.html"
      },
      {
        "category": "external",
        "summary": "WIBU Security Advisory WIBU-230802-01 vom 2023-08-17",
        "url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230802-01.pdf"
      }
    ],
    "source_lang": "en-US",
    "title": "Wibu-Systems CodeMeter: Schwachstelle erm\u00f6glicht Codeausf\u00fchrung und Privilegienerweiterung",
    "tracking": {
      "current_release_date": "2024-01-22T23:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:58:15.711+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-2311",
      "initial_release_date": "2023-09-12T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-09-12T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-01-22T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von WIBU-SYSTEMS aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Wibu-Systems CodeMeter",
            "product": {
              "name": "Wibu-Systems CodeMeter",
              "product_id": "T029822",
              "product_identification_helper": {
                "cpe": "cpe:/a:wibu:codemeter:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Wibu-Systems"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-3935",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Wibu-Systems CodeMeter. Dieser Fehler besteht aufgrund eines Heap-Puffer\u00fcberlaufs in der Runtime-Komponente. Ein entfernter, anonymer Angreifer kann diese Schwachstelle zur Ausf\u00fchrung von beliebigem Code ausnutzen. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029822"
        ]
      },
      "release_date": "2023-09-12T22:00:00.000+00:00",
      "title": "CVE-2023-3935"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "CODESYS ist eine herstellerunabh\u00e4ngige Automatisierungssoftware f\u00fcr die Entwicklung von Steuerungsanwendungen in der industriellen Automatisierung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in CODESYS ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder einen Brute-Force-Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-0943 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0943.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-0943 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0943"
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-06-27",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17090\u0026token=6cd08b169916366df31388d2e7ba58e7bce93508\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-04-03",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17555\u0026token=212fc7e39bdd260cab6d6ca84333d42f50bcb3da\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-03-08",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17764\u0026token=4b2f3cf3a800d076b22f18d49f278bd8883dbd46\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-10-31",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17765\u0026token=04e117e1408fdb8e02b4bc821aa3be819668aef4\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-08-03",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17766\u0026token=667d36292e99e6f6b7eb8c0b4a86d27137c31f98\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-10-31",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17767\u0026token=7ed2d9324eff98a0a319c455d0256dc7627c705e\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-08-03",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17768\u0026token=9d206ea9e0449cd9d3ee60d5179d2761dad2d2dd\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-07-26",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17769\u0026token=a1a34cd304aebfbc1e2619e401a9a6cb5d4dc117\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-12-05",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17809\u0026token=c3b4e3ec4956099de26f0c6caf194d1ba341040a\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2024-02-26",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=18027\u0026token=43109051cf95d3445bc616e4efb8414336ebcc47\u0026download="
      },
      {
        "category": "external",
        "summary": "ABB Security Advisory vom 2025-01-07",
        "url": "https://search.abb.com/library/Download.aspx?DocumentID=3ADR011377\u0026LanguageCode=en\u0026DocumentPartId=CSAF\u0026Action=Launch"
      }
    ],
    "source_lang": "en-US",
    "title": "CODESYS: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-01-07T23:00:00.000+00:00",
      "generator": {
        "date": "2025-01-08T10:42:29.688+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2024-0943",
      "initial_release_date": "2024-04-21T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-04-21T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-04-25T22:00:00.000+00:00",
          "number": "2",
          "summary": "Datum der Codesys Meldungen korrigiert."
        },
        {
          "date": "2025-01-07T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates aufgenommen"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.8.0",
                "product": {
                  "name": "ABB AC-500 \u003c3.8.0",
                  "product_id": "T040044"
                }
              },
              {
                "category": "product_version",
                "name": "3.8.0",
                "product": {
                  "name": "ABB AC-500 3.8.0",
                  "product_id": "T040044-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:ac-500:3.8.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "AC-500"
          }
        ],
        "category": "vendor",
        "name": "ABB"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "CODESYS CODESYS",
            "product": {
              "name": "CODESYS CODESYS",
              "product_id": "T034337",
              "product_identification_helper": {
                "cpe": "cpe:/a:codesys:codesys:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "CODESYS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-22516",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2022-22516"
    },
    {
      "cve": "CVE-2022-4046",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2022-4046"
    },
    {
      "cve": "CVE-2022-47391",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2022-47391"
    },
    {
      "cve": "CVE-2023-28355",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-28355"
    },
    {
      "cve": "CVE-2023-3662",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-3662"
    },
    {
      "cve": "CVE-2023-3663",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-3663"
    },
    {
      "cve": "CVE-2023-3669",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-3669"
    },
    {
      "cve": "CVE-2023-3670",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-3670"
    },
    {
      "cve": "CVE-2023-37545",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37545"
    },
    {
      "cve": "CVE-2023-37546",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37546"
    },
    {
      "cve": "CVE-2023-37547",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37547"
    },
    {
      "cve": "CVE-2023-37548",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37548"
    },
    {
      "cve": "CVE-2023-37549",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37549"
    },
    {
      "cve": "CVE-2023-37550",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37550"
    },
    {
      "cve": "CVE-2023-37551",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37551"
    },
    {
      "cve": "CVE-2023-37552",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37552"
    },
    {
      "cve": "CVE-2023-37553",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37553"
    },
    {
      "cve": "CVE-2023-37554",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37554"
    },
    {
      "cve": "CVE-2023-37555",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37555"
    },
    {
      "cve": "CVE-2023-37556",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37556"
    },
    {
      "cve": "CVE-2023-37557",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37557"
    },
    {
      "cve": "CVE-2023-37558",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37558"
    },
    {
      "cve": "CVE-2023-37559",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37559"
    },
    {
      "cve": "CVE-2023-3935",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-3935"
    },
    {
      "cve": "CVE-2023-6357",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-6357"
    }
  ]
}