github - ghsa-xchm-28cx-p56h

ghsa-xchm-28cx-p56h

Vulnerability from github

Published

2024-06-04 09:30

Modified

2024-06-04 09:30

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-5000"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-131"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-04T09:15:09Z",
    "severity": "HIGH"
  },
  "details": "An unauthenticated remote attacker can use a\u00a0malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.\n\n",
  "id": "GHSA-xchm-28cx-p56h",
  "modified": "2024-06-04T09:30:57Z",
  "published": "2024-06-04T09:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5000"
    },
    {
      "type": "WEB",
      "url": "https://cert.vde.com/en/advisories/VDE-2024-026"
    },
    {
      "type": "WEB",
      "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=18355\u0026token=e3e5a937ce72602bec39718ddc2f4ba6d983ccd1\u0026download="
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cve-2024-5000

Vulnerability from cvelistv5

Published

2024-06-04 08:54

Modified

2024-08-01 20:55

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

CODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA products

References

▼	URL	Tags
	https://cert.vde.com/en/advisories/VDE-2024-026
	https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=18355&token=e3e5a937ce72602bec39718ddc2f4ba6d983ccd1&download=

Impacted products

▼	Vendor	Product
	CODESYS	CODESYS Control for BeagleBone SL
	CODESYS	CODESYS Control for emPC-A/iMX6 SL
	CODESYS	CODESYS Control for IOT2000 SL
	CODESYS	CODESYS Control for Linux ARM SL
	CODESYS	CODESYS Control for Linux SL
	CODESYS	CODESYS Control for PFC100 SL
	CODESYS	CODESYS Control for PFC200 SL
	CODESYS	CODESYS Control for PLCnext SL
	CODESYS	CODESYS Control for Raspberry Pi SL
	CODESYS	CODESYS Control for WAGO Touch Panels 600 SL
	CODESYS	CODESYS Control RTE (for Beckhoff CX) SL
	CODESYS	CODESYS Control RTE (SL)
	CODESYS	CODESYS Runtime Toolkit
	CODESYS	CODESYS Control Win (SL)
	CODESYS	CODESYS HMI (SL)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:codesys:control_for_empc-a\\/imx6_sl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "control_for_empc-a\\/imx6_sl",
            "vendor": "codesys",
            "versions": [
              {
                "lessThan": "4.12.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "control_for_beaglebone_sl",
            "vendor": "codesys",
            "versions": [
              {
                "lessThan": "4.12.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "control_for_iot2000_sl",
            "vendor": "codesys",
            "versions": [
              {
                "lessThan": "4.12.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:codesys:control_for_linux_arm_sl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "control_for_linux_arm_sl",
            "vendor": "codesys",
            "versions": [
              {
                "lessThan": "4.12.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "control_for_linux_sl",
            "vendor": "codesys",
            "versions": [
              {
                "lessThan": "4.12.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "control_for_pfc200_sl",
            "vendor": "codesys",
            "versions": [
              {
                "lessThan": "4.12.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "control_for_plcnext_sl",
            "vendor": "codesys",
            "versions": [
              {
                "lessThan": "4.12.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "control_for_raspberry_pi_sl",
            "vendor": "codesys",
            "versions": [
              {
                "lessThan": "4.12.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "control_for_wago_touch_panels_600_sl",
            "vendor": "codesys",
            "versions": [
              {
                "lessThan": "4.12.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:codesys:control_rte_\\(for_beckhoff_cx\\)_sl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "control_rte_\\(for_beckhoff_cx\\)_sl",
            "vendor": "codesys",
            "versions": [
              {
                "lessThan": "3.5.20.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:codesys:control_rte_\\(sl\\):*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "control_rte_\\(sl\\)",
            "vendor": "codesys",
            "versions": [
              {
                "lessThan": "3.5.20.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:codesys:control_win_\\(sl\\):*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "control_win_\\(sl\\)",
            "vendor": "codesys",
            "versions": [
              {
                "lessThan": "3.5.20.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "runtime_toolkit",
            "vendor": "codesys",
            "versions": [
              {
                "lessThan": "3.5.20.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:codesys:hmi_\\(sl\\):*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "hmi_\\(sl\\)",
            "vendor": "codesys",
            "versions": [
              {
                "lessThan": "3.5.20.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-5000",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-06T14:26:44.507505Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-06T14:44:44.216Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:55:10.389Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert.vde.com/en/advisories/VDE-2024-026"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=18355\u0026token=e3e5a937ce72602bec39718ddc2f4ba6d983ccd1\u0026download="
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for BeagleBone SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.12.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for emPC-A/iMX6 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.12.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for IOT2000 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.12.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for Linux ARM SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.12.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for Linux SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.12.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for PFC100 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.12.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for PFC200 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.12.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for PLCnext SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.12.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for Raspberry Pi SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.12.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control for WAGO Touch Panels 600 SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "4.12.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control RTE (for Beckhoff CX) SL",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.20.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control RTE (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.20.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Runtime Toolkit",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.20.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS Control Win (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.20.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CODESYS HMI (SL)",
          "vendor": "CODESYS",
          "versions": [
            {
              "lessThan": "3.5.20.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "ABB Schweiz AG."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unauthenticated remote attacker can use a\u0026nbsp;malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "An unauthenticated remote attacker can use a\u00a0malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-131",
              "description": "CWE-131 Incorrect Calculation of Buffer Size",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-04T08:54:06.522Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://cert.vde.com/en/advisories/VDE-2024-026"
        },
        {
          "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=18355\u0026token=e3e5a937ce72602bec39718ddc2f4ba6d983ccd1\u0026download="
        }
      ],
      "source": {
        "advisory": "VDE-2024-026",
        "defect": [
          "CERT@VDE#641630"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "CODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA products",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2024-5000",
    "datePublished": "2024-06-04T08:54:06.522Z",
    "dateReserved": "2024-05-16T12:09:56.937Z",
    "dateUpdated": "2024-08-01T20:55:10.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted