Lucene search

[email protected]CVE-2019-9012

HistoryAug 15, 2019 - 6:15 p.m.

CVE-2019-9012

2019-08-1518:15:23

CWE-770

[email protected]

web.nvd.nist.gov

cve-2019-9012

codesys v3

denial-of-service

memory allocation

vulnerability

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.7%

JSON

An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products and may result in a denial-of-service condition. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.

Affected configurations

NVD

Node

codesyscontrol_for_beaglebone_slRange3.0–3.5.14.20

codesyscontrol_for_empc-a\/imx6_slRange3.0–3.5.14.20

codesyscontrol_for_iot2000_slRange3.0–3.5.14.20

codesyscontrol_for_linux_slRange3.0–3.5.14.20

codesyscontrol_for_pfc100_slRange3.0–3.5.14.20

codesyscontrol_for_pfc200_slRange3.0–3.5.14.20

codesyscontrol_for_raspberry_pi_slRange3.0–3.5.14.20

codesyscontrol_runtime_toolkitRange3.0–3.5.14.20

codesysdevelopment_systemRange3.0–3.5.14.20

codesysgatewayRange3.0–3.5.14.20

CPENameOperatorVersion
codesys:control_for_beaglebone_slcodesys control for beaglebone sllt3.5.14.20
codesys:control_for_empc-a\/imx6_slcodesys control for empc-a/imx6 sllt3.5.14.20
codesys:control_for_iot2000_slcodesys control for iot2000 sllt3.5.14.20
codesys:control_for_linux_slcodesys control for linux sllt3.5.14.20
codesys:control_for_pfc100_slcodesys control for pfc100 sllt3.5.14.20
codesys:control_for_pfc200_slcodesys control for pfc200 sllt3.5.14.20
codesys:control_for_raspberry_pi_slcodesys control for raspberry pi sllt3.5.14.20
codesys:control_runtime_toolkitcodesys control runtime toolkitlt3.5.14.20
codesys:development_systemcodesys development systemlt3.5.14.20
codesys:gatewaycodesys gatewaylt3.5.14.20

CPE	Name	Operator	Version
codesys:control_for_beaglebone_sl	codesys control for beaglebone sl	lt	3.5.14.20
codesys:control_for_empc-a\/imx6_sl	codesys control for empc-a/imx6 sl	lt	3.5.14.20
codesys:control_for_iot2000_sl	codesys control for iot2000 sl	lt	3.5.14.20
codesys:control_for_linux_sl	codesys control for linux sl	lt	3.5.14.20
codesys:control_for_pfc100_sl	codesys control for pfc100 sl	lt	3.5.14.20
codesys:control_for_pfc200_sl	codesys control for pfc200 sl	lt	3.5.14.20
codesys:control_for_raspberry_pi_sl	codesys control for raspberry pi sl	lt	3.5.14.20
codesys:control_runtime_toolkit	codesys control runtime toolkit	lt	3.5.14.20
codesys:development_system	codesys development system	lt	3.5.14.20
codesys:gateway	codesys gateway	lt	3.5.14.20

References

customers.codesys.com/index.php?eID=dumpFile&t=f&f=12938&token=b9eb30f53246dc57b2e7cb302356a05547148fa2&download=

www.us-cert.gov/ics/advisories/icsa-19-213-03

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.7%

JSON

Related for CVE-2019-9012

nessus2 nvd1 cvelist1 prion1 ics1