High severity · published Jul 28, 2023
CVE-2023-3670
In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the…
7.3
CVSS
0.2%
EPSS
No
On KEV
Description
In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
Development System · Codesys
3.5.9.0 before 3.5.17.0 · source: NVD
SC
Scripting · Codesys
4.0.0.0 before 4.1.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3670
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3670
Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2023-024
More from Development System
9.8
CVE-2019-9010
An issue was discovered in 3S-Smart CODESYS V3 products
8.8
CVE-2023-3663
In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of…
8.8
CVE-2022-4224
In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the…
8.8
CVE-2019-9013
An issue was discovered in 3S-Smart CODESYS V3 products
8.1
CVE-2022-22515
A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration…