CVE-2024-5000 CODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA products
HighCVSS 7.5
EPSS 0.57%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| CODESYS Control for BeagleBone SL | < 4.12.0.0 | 4.12.0.0 |
| CODESYS Control for emPC-A/iMX6 SL | < 4.12.0.0 | 4.12.0.0 |
| CODESYS Control for IOT2000 SL | < 4.12.0.0 | 4.12.0.0 |
| CODESYS Control for Linux ARM SL | < 4.12.0.0 | 4.12.0.0 |
| CODESYS Control for Linux SL | < 4.12.0.0 | 4.12.0.0 |
| CODESYS Control for PFC100 SL | < 4.12.0.0 | 4.12.0.0 |
| CODESYS Control for PFC200 SL | < 4.12.0.0 | 4.12.0.0 |
| CODESYS Control for PLCnext SL | < 4.12.0.0 | 4.12.0.0 |
| CODESYS Control for Raspberry Pi SL | < 4.12.0.0 | 4.12.0.0 |
| CODESYS Control for WAGO Touch Panels 600 SL | < 4.12.0.0 | 4.12.0.0 |
| CODESYS Control RTE (for Beckhoff CX) SL | < 3.5.20.10 | 3.5.20.10 |
| CODESYS Control RTE (SL) | < 3.5.20.10 | 3.5.20.10 |
| CODESYS Runtime Toolkit | < 3.5.20.10 | 3.5.20.10 |
| CODESYS Control Win (SL) | < 3.5.20.10 | 3.5.20.10 |
| CODESYS HMI (SL) | < 3.5.20.10 | 3.5.20.10 |