Codesys Development System v3 vulnerabilities

20 CVEs affecting Codesys Development System v3, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-5751, published 2024-06-04.

More from Codesys.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-20026, published 2019-02-19. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. Improper Communication Address Filtering exists in CODESYS V3 products versions prior V3.5.14.0.
• CVE-2022-47379, published 2023-05-15. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. An authenticated, remote attacker may use a out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into memory which can lead to a denial-of-service…
• CVE-2022-47391, published 2023-05-15. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service.
• CVE-2022-47386, published 2023-05-15. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack…
• CVE-2022-47385, published 2023-05-15. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple versions to write data into the stack…
• CVE-2022-47388, published 2023-05-15. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack…
• CVE-2022-47387, published 2023-05-15. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack…
• CVE-2022-47384, published 2023-05-15. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack…
• CVE-2022-47383, published 2023-05-15. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack…
• CVE-2022-47382, published 2023-05-15. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack…

Latest

• CVE-2023-5751, published 2024-06-04. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A local attacker with low privileges can read and modify any users files and cause a DoS in the working directory of the affected products due to exposure of resource to wrong sphere. 
• CVE-2022-47393, published 2023-05-15. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products to force a…
• CVE-2022-47392, published 2023-05-15. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions to read from an…
• CVE-2022-4048, published 2023-05-15. High severity, CVSS 7.7. EPSS: 0.1% chance of exploitation in the next 30 days. Inadequate Encryption Strength in CODESYS Development System V3 versions prior to V3.5.18.40 allows an unauthenticated local attacker to access and manipulate code of the encrypted boot application.
• CVE-2022-47390, published 2023-05-15. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack…
• CVE-2022-47389, published 2023-05-15. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack…