Read the docs
TI-2019-03564 Aliases CVE-2019-5105GHSA-fhfx-4gh6-9wc2

Memory corruption in 3S

Priority LOW 38CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService. A specially crafted packet can cause a large memcpy, resulting in an access violation and termination of the process. An attacker can send a packet to a device running the GatewayService.exe to trigger this vulnerability. All variants of the CODESYS V3 products in all versions prior V3.5.16.10 containing the CmpRouter or CmpRouterEmbedded component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PLCnext, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS Control V3 Runtime System Toolkit, CODESYS V3 Embedded Target Visu Toolkit, CODESYS V3 Remote Target Visu Toolkit, CODESYS V3 Safety SIL2, CODESYS Edge Gateway V3, CODESYS Gateway V3, CODESYS HMI V3, CODESYS OPC Server V3, CODESYS PLCHandler SDK, CODESYS V3 Simulation Runtime (part of the CODESYS Development System).

Why it matters now

EPSS 0.02646 85th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—3S3S-Smart Software Solutions CODESYS 3.5.15.0—No fix listedCNA
  • 3S Vendor— Affected 3S-Smart Software Solutions CODESYS 3.5.15.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:codesys:codesys:3.5.13.2:*:*:*:*:*:*:*3.5.13.2VulnerableCODESYS
  • cpe:2.3:a:codesys:codesys:3.5.13.2:*:*:*:*:*:*:* Versions 3.5.13.2 Vulnerable ·CODESYS

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-5105
  2. 2026-10-03 Alias added: GHSA-fhfx-4gh6-9wc2

References

Exploit 1

Other 1

  • TI-2021-13604 CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS) CVSS 3.1HIGH 7.5
  • TI-2019-12244 CODESYS V2.3 ENI server up to V3.2.2.24 has a Buffer Overflow. CVSS 3.1CRITICAL 9.8
  • TI-2021-13601 CODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS) CVSS 3.1HIGH 7.5
  • TI-2021-13602 CODESYS V2 web server: crafted requests could trigger a buffer over-read (DoS) CVSS 3.1CRITICAL 9.1
  • TI-2019-10170 3S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to… CVSS 3.1HIGH 8.6
  • TI-2021-04914 Deserialization of untrusted data in CODESYS CVSS 3.1HIGH 7.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences