Read the docs
TI-2024-07582 Aliases CVE-2024-8175GHSA-v6p4-r397-q442

CODESYS: web server vulnerable to DoS

Priority MEDIUM 40CWE-754Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00621 50th percentileScored 2026-11-07
Fix Fixed CODESYS Control for BeagleBone SL (CODESYS): 4.14.0.0CODESYS Control for emPC-A/iMX6 SL (CODESYS): 4.14.0.0+16 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CODESYSCODESYS Control for BeagleBone SLbefore 4.14.0.04.14.0.0Patch availableCNA
CODESYSCODESYS Control for emPC-A/iMX6 SLbefore 4.14.0.04.14.0.0Patch availableCNA
CODESYSCODESYS Control for IOT2000 SLbefore 4.14.0.04.14.0.0Patch availableCNA
CODESYSCODESYS Control for Linux ARM SLbefore 4.14.0.04.14.0.0Patch availableCNA
CODESYSCODESYS Control for Linux SLbefore 4.14.0.04.14.0.0Patch availableCNA
CODESYSCODESYS Control for PFC100 SLbefore 4.14.0.04.14.0.0Patch availableCNA
CODESYSCODESYS Control for PFC200 SLbefore 4.14.0.04.14.0.0Patch availableCNA
CODESYSCODESYS Control for PLCnext SLbefore 4.14.0.04.14.0.0Patch availableCNA
CODESYSCODESYS Control for Raspberry Pi SLbefore 4.14.0.04.14.0.0Patch availableCNA
CODESYSCODESYS Control for WAGO Touch Panels 600 SLbefore 4.14.0.04.14.0.0Patch availableCNA
CODESYSCODESYS Control RTE (for Beckhoff CX) SLbefore 3.5.20.303.5.20.30Patch availableCNA
CODESYSCODESYS Control RTE (SL)before 3.5.20.303.5.20.30Patch availableCNA
CODESYSCODESYS Control Win (SL)before 3.5.20.303.5.20.30Patch availableCNA
CODESYSCODESYS Embedded Target Visu Toolkitbefore 3.5.20.303.5.20.30Patch availableCNA
CODESYSCODESYS HMI (SL)before 3.5.20.303.5.20.30Patch availableCNA
CODESYSCODESYS Remote Target Visu Toolkitbefore 3.5.20.303.5.20.30Patch availableCNA
CODESYSCODESYS Runtime Toolkitbefore 3.5.20.303.5.20.30Patch availableCNA
CODESYSCODESYS Virtual Control SLbefore 4.14.0.04.14.0.0Patch availableCNA
  • CODESYS Control for BeagleBone SL VendorCODESYS Affected before 4.14.0.0 Fixed in 4.14.0.0 Patch available CNA
  • CODESYS Control for emPC-A/iMX6 SL VendorCODESYS Affected before 4.14.0.0 Fixed in 4.14.0.0 Patch available CNA
  • CODESYS Control for IOT2000 SL VendorCODESYS Affected before 4.14.0.0 Fixed in 4.14.0.0 Patch available CNA
  • CODESYS Control for Linux ARM SL VendorCODESYS Affected before 4.14.0.0 Fixed in 4.14.0.0 Patch available CNA
  • CODESYS Control for Linux SL VendorCODESYS Affected before 4.14.0.0 Fixed in 4.14.0.0 Patch available CNA
  • CODESYS Control for PFC100 SL VendorCODESYS Affected before 4.14.0.0 Fixed in 4.14.0.0 Patch available CNA
  • CODESYS Control for PFC200 SL VendorCODESYS Affected before 4.14.0.0 Fixed in 4.14.0.0 Patch available CNA
  • CODESYS Control for PLCnext SL VendorCODESYS Affected before 4.14.0.0 Fixed in 4.14.0.0 Patch available CNA
  • CODESYS Control for Raspberry Pi SL VendorCODESYS Affected before 4.14.0.0 Fixed in 4.14.0.0 Patch available CNA
  • CODESYS Control for WAGO Touch Panels 600 SL VendorCODESYS Affected before 4.14.0.0 Fixed in 4.14.0.0 Patch available CNA
  • CODESYS Control RTE (for Beckhoff CX) SL VendorCODESYS Affected before 3.5.20.30 Fixed in 3.5.20.30 Patch available CNA
  • CODESYS Control RTE (SL) VendorCODESYS Affected before 3.5.20.30 Fixed in 3.5.20.30 Patch available CNA
  • CODESYS Control Win (SL) VendorCODESYS Affected before 3.5.20.30 Fixed in 3.5.20.30 Patch available CNA
  • CODESYS Embedded Target Visu Toolkit VendorCODESYS Affected before 3.5.20.30 Fixed in 3.5.20.30 Patch available CNA
  • CODESYS HMI (SL) VendorCODESYS Affected before 3.5.20.30 Fixed in 3.5.20.30 Patch available CNA
  • CODESYS Remote Target Visu Toolkit VendorCODESYS Affected before 3.5.20.30 Fixed in 3.5.20.30 Patch available CNA
  • CODESYS Runtime Toolkit VendorCODESYS Affected before 3.5.20.30 Fixed in 3.5.20.30 Patch available CNA
  • CODESYS Virtual Control SL VendorCODESYS Affected before 4.14.0.0 Fixed in 4.14.0.0 Patch available CNA

CPE names CISA-ADP · 18

CPEVersionsRoleVendor
cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:control_for_linux_arm_sl:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:*——CODESYS
  • cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:control_for_linux_arm_sl:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:* Versions — — ·CODESYS
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:codesys:control_rte_\(for_beckhoff_cx\)_sl:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:virtual_control_sl:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:embedded_target_visu_toolkit:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:remote_target_visu_toolkit:*:*:*:*:*:*:*:*——CODESYS
cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:*:*——CODESYS
  • cpe:2.3:a:codesys:control_rte_\(for_beckhoff_cx\)_sl:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:virtual_control_sl:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:embedded_target_visu_toolkit:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:remote_target_visu_toolkit:*:*:*:*:*:*:*:* Versions — — ·CODESYS
  • cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:*:* Versions — — ·CODESYS

Remediation

  • Fix · CNA CODESYS Control for BeagleBone SL (CODESYS) Fixed in 4.14.0.0
  • Fix · CNA CODESYS Control for emPC-A/iMX6 SL (CODESYS) Fixed in 4.14.0.0
  • Fix · CNA CODESYS Control for IOT2000 SL (CODESYS) Fixed in 4.14.0.0
  • Fix · CNA CODESYS Control for Linux ARM SL (CODESYS) Fixed in 4.14.0.0
  • Fix · CNA CODESYS Control for Linux SL (CODESYS) Fixed in 4.14.0.0
  • Fix · CNA CODESYS Control for PFC100 SL (CODESYS) Fixed in 4.14.0.0
  • Fix · CNA CODESYS Control for PFC200 SL (CODESYS) Fixed in 4.14.0.0
  • Fix · CNA CODESYS Control for PLCnext SL (CODESYS) Fixed in 4.14.0.0
  • Fix · CNA CODESYS Control for Raspberry Pi SL (CODESYS) Fixed in 4.14.0.0
  • Fix · CNA CODESYS Control for WAGO Touch Panels 600 SL (CODESYS) Fixed in 4.14.0.0
  • Fix · CNA CODESYS Control RTE (for Beckhoff CX) SL (CODESYS) Fixed in 3.5.20.30
  • Fix · CNA CODESYS Control RTE (SL) (CODESYS) Fixed in 3.5.20.30
  • Fix · CNA CODESYS Control Win (SL) (CODESYS) Fixed in 3.5.20.30
  • Fix · CNA CODESYS Embedded Target Visu Toolkit (CODESYS) Fixed in 3.5.20.30
  • Fix · CNA CODESYS HMI (SL) (CODESYS) Fixed in 3.5.20.30
  • Fix · CNA CODESYS Remote Target Visu Toolkit (CODESYS) Fixed in 3.5.20.30
  • Fix · CNA CODESYS Runtime Toolkit (CODESYS) Fixed in 3.5.20.30
  • Fix · CNA CODESYS Virtual Control SL (CODESYS) Fixed in 4.14.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-8175
  2. 2026-10-03 Alias added: GHSA-v6p4-r397-q442
  3. 2026-11-07 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 1

  • TI-2021-12888 CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow. CVSS 3.1CRITICAL 9.8
  • TI-2019-10180 Stack-based buffer overflow in CODESYS V3 web server CVSS 3.1CRITICAL 9.8
  • TI-2021-13604 CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS) CVSS 3.1HIGH 7.5
  • TI-2020-08257 CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. CVSS 3.1CRITICAL 9.8
  • TI-2019-13592 CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. CVSS 3.1CRITICAL 9.8
  • TI-2017-03937 Unrestricted file upload in 3S-Smart Software Solutions GmbH CODESYS Web Server CVSS 3.0CRITICAL 9.8
See all 155 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences