Skip to content
Fencer Vulns
medium 6.5

CVE-2023-37558 json

CODESYS Improper Validation of Consistency within Input in multiple products

published 2023-08-03 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-41444

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37559

Patch / fix

  • CODESYS CODESYS Control for BeagleBone SL V4.10.0.0
  • CODESYS CODESYS Control for emPC-A/iMX6 SL V4.10.0.0
  • CODESYS CODESYS Control for IOT2000 SL V4.10.0.0
  • CODESYS CODESYS Control for Linux SL V4.10.0.0
  • CODESYS CODESYS Control for PFC100 SL V4.10.0.0
  • CODESYS CODESYS Control for PFC200 SL V4.10.0.0
  • CODESYS CODESYS Control for PLCnext SL V4.10.0.0
  • CODESYS CODESYS Control for Raspberry Pi SL V4.10.0.0
  • CODESYS CODESYS Control for WAGO Touch Panels 600 SL V4.10.0.0
  • CODESYS CODESYS Control RTE (for Beckhoff CX) SL V3.5.19.20
  • CODESYS CODESYS Control RTE (SL) V3.5.19.20
  • CODESYS CODESYS Control Runtime System Toolkit V3.5.19.20
  • CODESYS CODESYS Control Win (SL) V3.5.19.20
  • CODESYS CODESYS Development System V3 V3.5.19.20
  • CODESYS CODESYS HMI (SL) V3.5.19.20
  • CODESYS CODESYS Safety SIL2 Runtime Toolkit V3.5.19.20

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-076-01 updated cvss 6.5

CODESYS in Festo Automation Suite

  • CODESYS Development System 3.0 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138 CODESYS Development System 3.5.16.10 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138
    affected: mitigation
  • Festo Automation Suite 2.8.0.138 CODESYS Development System 3.5.21.20
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-26-020-02 updated cvss 6.5

Schneider Electric devices using CODESYS Runtime

  • Schneider Electric Easy Harmony HMIET6/HMIFT6 Magelis HMIGXU series <2.0_HF2
    affected: vendor fix se.com
  • Schneider Electric Easy Modicon M310 <3.1.5.82
    affected: vendor fix, mitigation se.com
  • Schneider Electric Harmony (Formerly Magelis) HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU series <6.3_HF3
    affected: fixed in v6.3
  • Schneider Electric Harmony iPC series Vijeo Designer runtime <6.3_SP2 Schneider Electric Harmony P6 series Vijeo Designer runtime <6.3_SP2
    affected: fixed in v6.3 se.com
  • Schneider Electric HMISCU Controller <6.3.1
    affected: fixed in v6.3.1, mitigation se.com
  • Schneider Electric Magelis XBT series
    affected: no fix planned
  • Schneider Electric Modicon Controller LMC058
    affected: mitigation
  • Schneider Electric Modicon Controller M241 <5.2.11.18 Schneider Electric Modicon Controller M251 <5.2.11.18
    affected: fixed in v2.2, mitigation se.com
show 6 more
  • Schneider Electric Modicon Controller M258
    affected: mitigation
  • Schneider Electric Modicon Controller M262 <5.2.8.12
    affected: fixed in v2.2, mitigation se.com
  • Schneider Electric PacDrive 3 Controllers: LMC Eco/Pro/Pro2 <1.76.14.1
    affected: fixed in V2.2, mitigation se.com
  • Schneider Electric SoftSPS embedded in EcoStruxure Machine Expert <2.2
    affected: vendor fix, mitigation se.com
  • Schneider Electric Vijeo Designer embedded in EcoStruxure Machine Expert <6.3.1
    affected: fixed in v6.3.1 se.com
  • Schneider Electric Easy Modicon M310 3.1.5.82 Schneider Electric Harmony (Formerly Magelis) HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU series iPC series with Vijeo Designer runtime 6.3_HF3 Schneider Electric Harmony iPC series Vijeo Designer runtime 6.3_SP2 Schneider Electric Harmony P6 series Vijeo Designer runtime 6.3_SP2 Schneider Electric HMISCU Controller 6.3.1 Schneider Electric Modicon Controller M241 5.2.11.18
    +6 more products
    Schneider Electric Modicon Controller M251 5.2.11.18 Schneider Electric Modicon Controller M262 5.2.8.12 Schneider Electric PacDrive 3 Controllers: LMC Eco/Pro/Pro2 1.76.14.1 Schneider Electric SoftSPS embedded in EcoStruxure Machine Expert 2.2 Schneider Electric Vijeo Designer Basic 2.0_HotFix_2 Schneider Electric Vijeo Designer embedded in EcoStruxure Machine Expert 6.3.1
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-112-04 updated cvss 6.5

ABB MV Drives

  • ABB ACS5000 >=LAAAB_4.03.0, <LAAAB_5.06.1 ABB ACS6000 >=LAAAA_2.10.0, <LAAAB_5.06.1 ABB ACS6080 >=LAAAA_2.10.0, <LAAAB_5.06.1
    affected: vendor fix
  • ABB ACS5000 LAAAB_5.07 ABB ACS6000 LAAAB_5.07 ABB ACS6080 LAAAB_5.07
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-093-03 updated cvss 6.5

ABB ACS880 Drives Containing CODESYS RTS

  • ABB ACS880 IGBT Supply Control Program <AISLX_v3.43, <ALHLX_v3.43, <YISLX_v1.30, <YLHLX_v1.30
    affected: vendor fix
  • ABB ACS880 Position Control Program <=APCLX_v1.04.0.5
    affected: workaround
  • ABB ACS880 Primary Control Program <AINLX_v3.47, <YINLX_v1.30
    affected: vendor fix
  • ABB ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0
    affected: workaround
  • ABB ACS880 IGBT Supply Control Program >=AISLX_v3.43, >=ALHLX_v3.43, >=YISLX_v1.30, >=YLHLX_v1.30 ABB ACS880 Primary Control Program >=AINLX_v3.47, >=YINLX_v1.30
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-093-04 updated cvss 6.5

ABB Low Voltage DC Drives and Power Controllers CODESYS RTS

  • ABB Drive Application Builder license (IEC 61131-3) ABB DC drives & power controllers ABB Power Optimizer
    affected: workaround

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • CODESYS CODESYS Control for BeagleBone SL
  • CODESYS CODESYS Control for emPC-A/iMX6 SL
  • CODESYS CODESYS Control for IOT2000 SL
  • CODESYS CODESYS Control for Linux SL
  • CODESYS CODESYS Control for PFC100 SL
  • CODESYS CODESYS Control for PFC200 SL
  • CODESYS CODESYS Control for PLCnext SL
  • CODESYS CODESYS Control for Raspberry Pi SL
  • CODESYS CODESYS Control for WAGO Touch Panels 600 SL
  • CODESYS CODESYS Control RTE (for Beckhoff CX) SL
  • CODESYS CODESYS Control RTE (SL)
  • CODESYS CODESYS Control Runtime System Toolkit
  • CODESYS CODESYS Control Win (SL)
  • CODESYS CODESYS Development System V3
  • CODESYS CODESYS HMI (SL)
  • CODESYS CODESYS Safety SIL2 Runtime Toolkit

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.