CVE-2023-37551

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-552

Affected software

No affected versions have been published.

Timeline

Published
Aug 3, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-375526.5In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requestCVE-2023-375536.5In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requestCVE-2023-375546.5In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requestCVE-2023-375556.5In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requestCVE-2023-375566.5In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requestCVE-2023-375576.5After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests CVE-2023-375586.5After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requestsCVE-2023-375596.5After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requestsCVE-2023-37566.1A vulnerability was found in Creativeitem Atlas Business Directory Listing 2.13 and classified as problematic. Affected by this issue is somCVE-2023-375606.1Cross-site scripting vulnerability in WRH-300WH-H v2.12 and earlier, and WTC-300HWH v1.09 and earlier allows a remote unauthenticated attackCVE-2023-375616.1Open redirect vulnerability in ELECOM wireless LAN routers and ELECOM wireless LAN repeaters allows a remote unauthenticated attacker to redCVE-2023-375628.8Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user
CVE-2023-37551: Medium severity, CVSS 6.5 | Vulnix