Description
A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
CODESYS CODESYS Control RTE (SL)
V3.5.18.0 to < V3.5.18.0affected
CODESYS CODESYS Control RTE (for Beckhoff CX) SL
V3.5.18.0 to < V3.5.18.0affected
CODESYS CODESYS Control Win (SL)
V3.5.18.0 to < V3.5.18.0affected
CODESYS CODESYS HMI (SL)
V3.5.18.0 to < V3.5.18.0affected
CODESYS CODESYS Control Runtime System Toolkit
V3.5.18.0 to < V3.5.18.0affected
CODESYS CODESYS Embedded Target Visu Toolkit
V3.5.18.0 to < V3.5.18.0affected
CODESYS CODESYS Remote Target Visu Toolkit
V3.5.18.0 to < V3.5.18.0affected
CODESYS CODESYS Control for BeagleBone SL
V4.5.0.0 to < V4.5.0.0affected
CODESYS CODESYS Control for Beckhoff CX9020 SL
V4.5.0.0 to < V4.5.0.0affected
CODESYS CODESYS Control for emPC-A/iMX6 SL
V4.5.0.0 to < V4.5.0.0affected
CODESYS CODESYS Control for IOT2000 SL
V4.5.0.0 to < V4.5.0.0affected
CODESYS CODESYS Control for Linux SL
V4.5.0.0 to < V4.5.0.0affected
CODESYS CODESYS Control for PFC100 SL
V4.5.0.0 to < V4.5.0.0affected
CODESYS CODESYS Control for PFC200 SL
V4.5.0.0 to < V4.5.0.0affected
CODESYS CODESYS Control for PLCnext SL
V4.5.0.0 to < V4.5.0.0affected
CODESYS CODESYS Control for Raspberry Pi SL
V4.5.0.0 to < V4.5.0.0affected
CODESYS CODESYS Control for WAGO Touch Panels 600 SL
V4.5.0.0 to < V4.5.0.0affected