CVE-2019-9012 - CVE House
Back to Database
Status published High CVE-2019-9012

An issue was discovered in 3S-Smart CODESYS V3 products. A...

Vulnerability Description

An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products and may result in a denial-of-service condition. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9012

Credits & Attribution

No credits recorded in the NVD database.

References

More from codesys

View All →
CVE-2022-22510
CODESYS: Null Pointer Dereference in CODESYS PROFINET stack
High 7.5
CVE-2021-36765
In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause...
High 7.5
CVE-2021-36764
In CODESYS Gateway V3 before 3.5.17.10, there is a NULL...
High 7.5
CVE-2021-36763
In CODESYS V3 web server before 3.5.17.10, files or directories...
High 7.5
CVE-2021-33486
All versions of the CODESYS V3 Runtime Toolkit for VxWorks...
High 7.5

Affected Vendor

Affected Software

control for beaglebone sl, control for empc-a\/imx6 sl, control for iot2000 sl, control for linux sl, control for pfc100 sl, control for pfc200 sl, control for raspberry pi sl, control runtime toolkit, development system, gateway
Vulnerable Versions:
3.0

Timeline

Official Publish: August 15th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.