{"id":"CVE-2024-5000","state":"PUBLISHED","title":"CODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA products","description":"An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.\n\n","publishedAt":"2024-06-04T08:54:06.522Z","updatedAt":"2024-08-01T20:55:10.389Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"CERTVDE"},"assigner":"CERTVDE","products":["CODESYS CODESYS Control for BeagleBone SL","CODESYS CODESYS Control for emPC-A/iMX6 SL","CODESYS CODESYS Control for IOT2000 SL","CODESYS CODESYS Control for Linux ARM SL","CODESYS CODESYS Control for Linux SL","CODESYS CODESYS Control for PFC100 SL","CODESYS CODESYS Control for PFC200 SL","CODESYS CODESYS Control for PLCnext SL","CODESYS CODESYS Control for Raspberry Pi SL","CODESYS CODESYS Control for WAGO Touch Panels 600 SL","CODESYS CODESYS Control RTE (for Beckhoff CX) SL","CODESYS CODESYS Control RTE (SL)","CODESYS CODESYS Runtime Toolkit","CODESYS CODESYS Control Win (SL)","CODESYS CODESYS HMI (SL)"],"affected":[{"vendor":"CODESYS","product":"CODESYS Control for BeagleBone SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for emPC-A/iMX6 SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for IOT2000 SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for Linux ARM SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for Linux SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for PFC100 SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for PFC200 SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for PLCnext SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for Raspberry Pi SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for WAGO Touch Panels 600 SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control RTE (for Beckhoff CX) SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.20.10","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control RTE (SL)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.20.10","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Runtime Toolkit","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.20.10","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control Win (SL)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.20.10","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS HMI (SL)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.20.10","versionType":"semver"}]}],"references":["https://cert.vde.com/en/advisories/VDE-2024-026","https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=18355&token=e3e5a937ce72602bec39718ddc2f4ba6d983ccd1&download="],"weaknesses":["CWE-131"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/5xxx/CVE-2024-5000.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-5000","state":"PUBLISHED","datePublished":"2024-06-04T08:54:06.522Z","dateUpdated":"2024-08-01T20:55:10.389Z","assignerShortName":"CERTVDE","assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateReserved":"2024-05-16T12:09:56.937Z"},"containers":{"cna":{"title":"CODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA products","descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.\n\n"}],"affected":[{"vendor":"CODESYS","product":"CODESYS Control for BeagleBone SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for emPC-A/iMX6 SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for IOT2000 SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for Linux ARM SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for Linux SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for PFC100 SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for PFC200 SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for PLCnext SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for Raspberry Pi SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control for WAGO Touch Panels 600 SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control RTE (for Beckhoff CX) SL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.20.10","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control RTE (SL)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.20.10","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Runtime Toolkit","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.20.10","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Control Win (SL)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.20.10","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS HMI (SL)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.20.10","versionType":"semver"}]}],"references":[{"url":"https://cert.vde.com/en/advisories/VDE-2024-026"},{"url":"https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=18355&token=e3e5a937ce72602bec39718ddc2f4ba6d983ccd1&download="}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-131","description":"CWE-131 Incorrect Calculation of Buffer Size","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERTVDE","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateUpdated":"2024-06-04T08:54:06.522Z"},"credits":[{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"ABB Schweiz AG."}],"source":{"advisory":"VDE-2024-026","defect":["CERT@VDE#641630"],"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"codesys","product":"control_for_empc-a\\/imx6_sl","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"custom"}],"cpes":["cpe:2.3:a:codesys:control_for_empc-a\\/imx6_sl:*:*:*:*:*:*:*:*"]},{"vendor":"codesys","product":"control_for_beaglebone_sl","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"custom"}],"cpes":["cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:*"]},{"vendor":"codesys","product":"control_for_iot2000_sl","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"custom"}],"cpes":["cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*"]},{"vendor":"codesys","product":"control_for_linux_arm_sl","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"custom"}],"cpes":["cpe:2.3:a:codesys:control_for_linux_arm_sl:*:*:*:*:*:*:*:*"]},{"vendor":"codesys","product":"control_for_linux_sl","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"custom"}],"cpes":["cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*"]},{"vendor":"codesys","product":"control_for_pfc200_sl","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"custom"}],"cpes":["cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*"]},{"vendor":"codesys","product":"control_for_plcnext_sl","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"custom"}],"cpes":["cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:*"]},{"vendor":"codesys","product":"control_for_raspberry_pi_sl","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"custom"}],"cpes":["cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:*"]},{"vendor":"codesys","product":"control_for_wago_touch_panels_600_sl","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"4.12.0.0","versionType":"custom"}],"cpes":["cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:*"]},{"vendor":"codesys","product":"control_rte_\\(for_beckhoff_cx\\)_sl","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.5.20.10","versionType":"custom"}],"cpes":["cpe:2.3:a:codesys:control_rte_\\(for_beckhoff_cx\\)_sl:*:*:*:*:*:*:*:*"]},{"vendor":"codesys","product":"control_rte_\\(sl\\)","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.5.20.10","versionType":"custom"}],"cpes":["cpe:2.3:a:codesys:control_rte_\\(sl\\):*:*:*:*:*:*:*:*"]},{"vendor":"codesys","product":"control_win_\\(sl\\)","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.5.20.10","versionType":"custom"}],"cpes":["cpe:2.3:a:codesys:control_win_\\(sl\\):*:*:*:*:*:*:*:*"]},{"vendor":"codesys","product":"runtime_toolkit","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.5.20.10","versionType":"custom"}],"cpes":["cpe:2.3:a:codesys:runtime_toolkit:*:*:*:*:*:*:*:*"]},{"vendor":"codesys","product":"hmi_\\(sl\\)","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.5.20.10","versionType":"custom"}],"cpes":["cpe:2.3:a:codesys:hmi_\\(sl\\):*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-06T14:26:44.507505Z","id":"CVE-2024-5000","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-06T14:44:44.216Z"}},{"title":"CVE Program Container","references":[{"url":"https://cert.vde.com/en/advisories/VDE-2024-026","tags":["x_transferred"]},{"url":"https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=18355&token=e3e5a937ce72602bec39718ddc2f4ba6d983ccd1&download=","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T20:55:10.389Z"}}]}}}