{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      },
      {
        "organization": "OEM customer",
        "summary": "reporting"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "The CODESYS Development System does not limit the number of attempts to guess the password within an import dialog.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "A limited amount of information can be obtained by a local attacker if the brute-force attack was successful.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Update the CODESYS Development System to version 3.5.19.20.\nThe CODESYS Development System can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store.\nAlternatively, you will find further information on obtaining the software update in the CODESYS Update area",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@codesys.com",
      "name": "CODESYS GmbH",
      "namespace": "https://www.codesys.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2023-023: CODESYS: Missing Brute-Force protection in CODESYS Development System - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2023-023/"
      },
      {
        "category": "self",
        "summary": "VDE-2023-023: CODESYS: Missing Brute-Force protection in CODESYS Development System - CSAF",
        "url": "https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-023.json"
      },
      {
        "category": "external",
        "summary": "Vendor PSIRT",
        "url": "https://www.codesys.com"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for CODESYS GmbH",
        "url": "https://certvde.com/en/advisories/vendor/codesys/"
      }
    ],
    "title": "CODESYS: Missing Brute-Force protection in CODESYS Development System",
    "tracking": {
      "aliases": [
        "VDE-2023-023"
      ],
      "current_release_date": "2023-08-03T11:08:00.000Z",
      "generator": {
        "date": "2025-04-23T08:54:14.915Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.23"
        }
      },
      "id": "VDE-2023-023",
      "initial_release_date": "2023-08-03T11:08:00.000Z",
      "revision_history": [
        {
          "date": "2023-08-03T11:08:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c3.5.19.20",
                    "product": {
                      "name": "CODESYS Development System \u003c3.5.19.20",
                      "product_id": "CSAFPID-51001"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.5.19.20",
                    "product": {
                      "name": "CODESYS Development System 3.5.19.20",
                      "product_id": "CSAFPID-52001"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Development System"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "CODESYS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-3669",
      "cwe": {
        "id": "CWE-307",
        "name": "Improper Restriction of Excessive Authentication Attempts"
      },
      "notes": [
        {
          "category": "description",
          "text": "A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52001"
        ],
        "known_affected": [
          "CSAFPID-51001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update the CODESYS Development System to version 3.5.19.20.\nThe CODESYS Development System can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store.\nAlternatively, you will find further information on obtaining the software update in the CODESYS Update area",
          "product_ids": [
            "CSAFPID-51001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "environmentalScore": 3.3,
            "environmentalSeverity": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 3.3,
            "temporalSeverity": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001"
          ]
        }
      ],
      "title": "CVE-2023-3669"
    }
  ]
}