CVE-2023-37549 - CVE House
Back to Database
Status published Medium CVE-2023-37549

CODESYS: Improper Input Validation in CmpApp component

Vulnerability Description

In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37550

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-37549

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Vladimir Tokarev, Section 52, Azure IoT Security at Microsoft

References

More from CODESYS

View All →
CVE-2025-41739
CODESYS Control - Linux/QNX SysSocket flaw
Medium 5.9
CVE-2025-41738
CODESYS Control - Invalid type usage in visualization
High 7.5
CVE-2025-41700
CODESYS Development System - Deserialization of Untrusted Data
High 7.8
CVE-2025-41691
CODESYS Control DoS via Unauthenticated NULL Pointer Dereference
High 7.5
CVE-2025-41660
CODESYS Control Boot Application Replacement Enables Code Execution
High 8.8

Affected Vendor

Affected Software

CODESYS Control for BeagleBone SL, CODESYS Control for emPC-A/iMX6 SL, CODESYS Control for IOT2000 SL, CODESYS Control for Linux SL, CODESYS Control for PFC100 SL, CODESYS Control for PFC200 SL, CODESYS Control for PLCnext SL, CODESYS Control for Raspberry Pi SL, CODESYS Control for WAGO Touch Panels 600 SL, CODESYS Control RTE (for Beckhoff CX) SL, CODESYS Control RTE (SL), CODESYS Control Runtime System Toolkit, CODESYS Control Win (SL), CODESYS Development System V3, CODESYS HMI (SL), CODESYS Safety SIL2 Runtime Toolkit
Vulnerable Versions:
0

Timeline

Official Publish: August 3rd, 2023
Last Modified: October 11th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact