Read the docs
TI-2023-19153 Aliases CVE-2023-37555GHSA-4269-36rj-fxq8

CODESYS Improper Input Validation in CmpAppBP

Priority LOW 30CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37556.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00626 50th percentileScored 2026-11-07
Fix Fixed CODESYS Control for BeagleBone SL (CODESYS): V4.10.0.0CODESYS Control for emPC-A/iMX6 SL (CODESYS): V4.10.0.0+14 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CODESYSCODESYS Control for BeagleBone SLbefore V4.10.0.0V4.10.0.0Patch availableCNA
CODESYSCODESYS Control for emPC-A/iMX6 SLbefore V4.10.0.0V4.10.0.0Patch availableCNA
CODESYSCODESYS Control for IOT2000 SLbefore V4.10.0.0V4.10.0.0Patch availableCNA
CODESYSCODESYS Control for Linux SLbefore V4.10.0.0V4.10.0.0Patch availableCNA
CODESYSCODESYS Control for PFC100 SLbefore V4.10.0.0V4.10.0.0Patch availableCNA
CODESYSCODESYS Control for PFC200 SLbefore V4.10.0.0V4.10.0.0Patch availableCNA
CODESYSCODESYS Control for PLCnext SLbefore V4.10.0.0V4.10.0.0Patch availableCNA
CODESYSCODESYS Control for Raspberry Pi SLbefore V4.10.0.0V4.10.0.0Patch availableCNA
CODESYSCODESYS Control for WAGO Touch Panels 600 SLbefore V4.10.0.0V4.10.0.0Patch availableCNA
CODESYSCODESYS Control RTE (for Beckhoff CX) SLbefore V3.5.19.20V3.5.19.20Patch availableCNA
CODESYSCODESYS Control RTE (SL)before V3.5.19.20V3.5.19.20Patch availableCNA
CODESYSCODESYS Control Runtime System Toolkitbefore V3.5.19.20V3.5.19.20Patch availableCNA
CODESYSCODESYS Control Win (SL)before V3.5.19.20V3.5.19.20Patch availableCNA
CODESYSCODESYS Development System V3before V3.5.19.20V3.5.19.20Patch availableCNA
CODESYSCODESYS HMI (SL)before V3.5.19.20V3.5.19.20Patch availableCNA
CODESYSCODESYS Safety SIL2 Runtime Toolkitbefore V3.5.19.20V3.5.19.20Patch availableCNA
  • CODESYS Control for BeagleBone SL VendorCODESYS Affected before V4.10.0.0 Fixed in V4.10.0.0 Patch available CNA
  • CODESYS Control for emPC-A/iMX6 SL VendorCODESYS Affected before V4.10.0.0 Fixed in V4.10.0.0 Patch available CNA
  • CODESYS Control for IOT2000 SL VendorCODESYS Affected before V4.10.0.0 Fixed in V4.10.0.0 Patch available CNA
  • CODESYS Control for Linux SL VendorCODESYS Affected before V4.10.0.0 Fixed in V4.10.0.0 Patch available CNA
  • CODESYS Control for PFC100 SL VendorCODESYS Affected before V4.10.0.0 Fixed in V4.10.0.0 Patch available CNA
  • CODESYS Control for PFC200 SL VendorCODESYS Affected before V4.10.0.0 Fixed in V4.10.0.0 Patch available CNA
  • CODESYS Control for PLCnext SL VendorCODESYS Affected before V4.10.0.0 Fixed in V4.10.0.0 Patch available CNA
  • CODESYS Control for Raspberry Pi SL VendorCODESYS Affected before V4.10.0.0 Fixed in V4.10.0.0 Patch available CNA
  • CODESYS Control for WAGO Touch Panels 600 SL VendorCODESYS Affected before V4.10.0.0 Fixed in V4.10.0.0 Patch available CNA
  • CODESYS Control RTE (for Beckhoff CX) SL VendorCODESYS Affected before V3.5.19.20 Fixed in V3.5.19.20 Patch available CNA
  • CODESYS Control RTE (SL) VendorCODESYS Affected before V3.5.19.20 Fixed in V3.5.19.20 Patch available CNA
  • CODESYS Control Runtime System Toolkit VendorCODESYS Affected before V3.5.19.20 Fixed in V3.5.19.20 Patch available CNA
  • CODESYS Control Win (SL) VendorCODESYS Affected before V3.5.19.20 Fixed in V3.5.19.20 Patch available CNA
  • CODESYS Development System V3 VendorCODESYS Affected before V3.5.19.20 Fixed in V3.5.19.20 Patch available CNA
  • CODESYS HMI (SL) VendorCODESYS Affected before V3.5.19.20 Fixed in V3.5.19.20 Patch available CNA
  • CODESYS Safety SIL2 Runtime Toolkit VendorCODESYS Affected before V3.5.19.20 Fixed in V3.5.19.20 Patch available CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:*before 4.10.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:*before 4.10.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*before 4.10.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*before 4.10.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:*before 4.10.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*before 4.10.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:*before 4.10.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*before 4.10.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:*before 4.10.0.0VulnerableCODESYS
cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:*before 3.5.19.20VulnerableCODESYS
  • cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:* Versions before 4.10.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:* Versions before 4.10.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:* Versions before 4.10.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:* Versions before 4.10.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:* Versions before 4.10.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:* Versions before 4.10.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:* Versions before 4.10.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:* Versions before 4.10.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:* Versions before 4.10.0.0 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:* Versions before 3.5.19.20 Vulnerable ·CODESYS
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\):*:*:*:*:*:*:*:*before 3.5.19.20VulnerableCODESYS
cpe:2.3:a:codesys:control_runtime_system_toolkit:*:*:*:*:*:*:*:*before 3.5.19.20VulnerableCODESYS
cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:*before 3.5.19.20VulnerableCODESYS
cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*before 3.5.19.20VulnerableCODESYS
cpe:2.3:a:codesys:hmi:*:*:*:*:*:*:*:*before 3.5.19.20VulnerableCODESYS
cpe:2.3:a:codesys:safety_sil2:*:*:*:*:*:*:*:*before 3.5.19.20VulnerableCODESYS
  • cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\):*:*:*:*:*:*:*:* Versions before 3.5.19.20 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_runtime_system_toolkit:*:*:*:*:*:*:*:* Versions before 3.5.19.20 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:* Versions before 3.5.19.20 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:* Versions before 3.5.19.20 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:hmi:*:*:*:*:*:*:*:* Versions before 3.5.19.20 Vulnerable ·CODESYS
  • cpe:2.3:a:codesys:safety_sil2:*:*:*:*:*:*:*:* Versions before 3.5.19.20 Vulnerable ·CODESYS

Remediation

  • Fix · CNA CODESYS Control for BeagleBone SL (CODESYS) Fixed in V4.10.0.0
  • Fix · CNA CODESYS Control for emPC-A/iMX6 SL (CODESYS) Fixed in V4.10.0.0
  • Fix · CNA CODESYS Control for IOT2000 SL (CODESYS) Fixed in V4.10.0.0
  • Fix · CNA CODESYS Control for Linux SL (CODESYS) Fixed in V4.10.0.0
  • Fix · CNA CODESYS Control for PFC100 SL (CODESYS) Fixed in V4.10.0.0
  • Fix · CNA CODESYS Control for PFC200 SL (CODESYS) Fixed in V4.10.0.0
  • Fix · CNA CODESYS Control for PLCnext SL (CODESYS) Fixed in V4.10.0.0
  • Fix · CNA CODESYS Control for Raspberry Pi SL (CODESYS) Fixed in V4.10.0.0
  • Fix · CNA CODESYS Control for WAGO Touch Panels 600 SL (CODESYS) Fixed in V4.10.0.0
  • Fix · CNA CODESYS Control RTE (for Beckhoff CX) SL (CODESYS) Fixed in V3.5.19.20
  • Fix · CNA CODESYS Control RTE (SL) (CODESYS) Fixed in V3.5.19.20
  • Fix · CNA CODESYS Control Runtime System Toolkit (CODESYS) Fixed in V3.5.19.20
  • Fix · CNA CODESYS Control Win (SL) (CODESYS) Fixed in V3.5.19.20
  • Fix · CNA CODESYS Development System V3 (CODESYS) Fixed in V3.5.19.20
  • Fix · CNA CODESYS HMI (SL) (CODESYS) Fixed in V3.5.19.20
  • Fix · CNA CODESYS Safety SIL2 Runtime Toolkit (CODESYS) Fixed in V3.5.19.20

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    CODESYS Control RTE (SL), CODESYS Control RTE (for Beckhoff CX) SL and 14 more products V3.5.19.20, V4.10.0.0

    15 records Highest priority Priority LOW 15 LOW

    Other records, highest priority first

    • TI-2023-19157 CODESYS Improper Validation of Consistency within Input in multiple productsPriority LOW 30
    • TI-2023-19156 CODESYS Improper Validation of Consistency within Input in multiple productsPriority LOW 30
    • TI-2023-19155 CODESYS Heap-based Buffer Overflow in multiple productsPriority LOW 30
    Show all 15 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-37555
  2. 2026-10-03 Alias added: GHSA-4269-36rj-fxq8
  3. 2026-10-31 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2019-06497 An issue was discovered in 3S-Smart CODESYS V3 products. CVSS 3.1CRITICAL 9.8
  • TI-2018-07501 Improper access control in 3S-Smart Software Solutions GmbH CODESYS Control V3 products… CVSS 3.0CRITICAL 9.8
  • TI-2022-23467 CODESYS: Multiple products prone to out-of-bounds write CVSS 3.1HIGH 8.8
  • TI-2022-23479 CODESYS: Multiple products prone to Improper Input Validation CVSS 3.1HIGH 7.5
  • TI-2022-23478 CODESYS: Multiple products prone to stack based out-of-bounds write CVSS 3.1HIGH 8.8
  • TI-2022-23477 CODESYS: Multiple products prone to stack based out-of-bounds write CVSS 3.1HIGH 8.8
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences