CVE-2023-37549: Codesys Control For Beaglebone Sl

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37550

Affected products

Codesys Control For Beaglebone Sl: before 4.10.0.0 (fixed in 4.10.0.0)
Codesys Control For Empc-a/imx6 Sl: before 4.10.0.0 (fixed in 4.10.0.0)
Codesys Control For IOT2000 Sl: before 4.10.0.0 (fixed in 4.10.0.0)
Codesys Control For Linux Sl: before 4.10.0.0 (fixed in 4.10.0.0)
Codesys Control For PFC100 Sl: before 4.10.0.0 (fixed in 4.10.0.0)
Codesys Control For PFC200 Sl: before 4.10.0.0 (fixed in 4.10.0.0)
Codesys Control For Plcnext Sl: before 4.10.0.0 (fixed in 4.10.0.0)
Codesys Control For Raspberry Pi Sl: before 4.10.0.0 (fixed in 4.10.0.0)
Codesys Control For Wago Touch Panels 600 Sl: before 4.10.0.0 (fixed in 4.10.0.0)
Codesys Control Rte Sl: before 3.5.19.20 (fixed in 3.5.19.20)
Codesys Control Rte Sl (for Beckhoff Cx): before 3.5.19.20 (fixed in 3.5.19.20)
Codesys Control Runtime System Toolkit: before 3.5.19.20 (fixed in 3.5.19.20)
Codesys Control Win Sl: before 3.5.19.20 (fixed in 3.5.19.20)
Codesys Development System: before 3.5.19.20 (fixed in 3.5.19.20)
Codesys HMI: before 3.5.19.20 (fixed in 3.5.19.20)
Codesys Safety SIL2: before 3.5.19.20 (fixed in 3.5.19.20)

Published 2023-08-03. Last modified 2026-06-17.