CVE-2024-8175

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-754

Affected software

VendorProductVersions
CODESYSCODESYS Control for BeagleBone SL< 4.14.0.0
CODESYSCODESYS Control for emPC-A/iMX6 SL< 4.14.0.0
CODESYSCODESYS Control for IOT2000 SL< 4.14.0.0
CODESYSCODESYS Control for Linux ARM SL< 4.14.0.0
CODESYSCODESYS Control for Linux SL< 4.14.0.0
CODESYSCODESYS Control for PFC100 SL< 4.14.0.0
CODESYSCODESYS Control for PFC200 SL< 4.14.0.0
CODESYSCODESYS Control for PLCnext SL< 4.14.0.0
CODESYSCODESYS Control for Raspberry Pi SL< 4.14.0.0
CODESYSCODESYS Control for WAGO Touch Panels 600 SL< 4.14.0.0
CODESYSCODESYS Control RTE (for Beckhoff CX) SL< 3.5.20.30
CODESYSCODESYS Control RTE (SL)< 3.5.20.30
CODESYSCODESYS Control Win (SL)< 3.5.20.30
CODESYSCODESYS Embedded Target Visu Toolkit< 3.5.20.30
CODESYSCODESYS HMI (SL)< 3.5.20.30
CODESYSCODESYS Remote Target Visu Toolkit< 3.5.20.30
CODESYSCODESYS Runtime Toolkit< 3.5.20.30
CODESYSCODESYS Virtual Control SL< 4.14.0.0
codesysruntime_toolkit< 4.14.0.0
codesyscontrol_rte_\(for_beckhoff_cx\)_sl< 3.5.20.30
codesysvirtual_control_sl< 4.14.0.0
codesysruntime_toolkit< 3.5.20.30

References

Timeline

Published
Sep 25, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-81767.5A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When paCVE-2024-81777.5An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, startCVE-2024-81788.8The ctl_write_buffer and ctl_read_buffer functions allocated memory to be returned to userspace, without initializing it. Malicious softwarCVE-2024-81795.4An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. ImpCVE-2024-81805.4An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. ImpCVE-2024-81818.1An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API enCVE-2024-81827.5An Unauthenticated Denial of Service (DoS) vulnerability exists in Flowise version 1.8.2 leading to a complete crash of the instance runningCVE-2024-81837.6A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive CVE-2024-81846.5There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remoteCVE-2024-81857.5Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS)CVE-2024-81865.4An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An CVE-2024-81874.8The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users
CVE-2024-8175: High severity, CVSS 7.5 | Vulnix