7.5

CVE-2020-15806

Exploit
CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Codesys ≫ Control For Beaglebone Version < 3.5.16.10
Codesys ≫ Control For Empc-a/imx6 Version < 3.5.16.10
Codesys ≫ Control For Iot2000 Version < 3.5.16.10
Codesys ≫ Control For Linux Version < 3.5.16.10
Codesys ≫ Control For Pfc100 Version < 3.5.16.10
Codesys ≫ Control For Pfc200 Version < 3.5.16.10
Codesys ≫ Control For Plcnext Version < 3.5.16.10
Codesys ≫ Control For Raspberry Pi Version < 3.5.16.10
Codesys ≫ Control Rte SwPlatform- Version >= 3.5.8.60 < 3.5.16.10
Codesys ≫ Control Rte SwPlatformbeckhoff_cx Version >= 3.5.8.60 < 3.5.16.10
Codesys ≫ Control Runtime System Toolkit Version >= 3.0 < 3.5.16.10
Codesys ≫ Control Win Version >= 3.5.9.80 < 3.5.16.10
Codesys ≫ Embedded Target Visu Toolkit Version >= 3.0 < 3.5.16.10
Codesys ≫ Hmi Version >= 3.5.10.0 < 3.5.16.10
Codesys ≫ Remote Target Visu Toolkit Version >= 3.0 < 3.5.16.10
Codesys ≫ Simulation Runtime Version >= 3.5.9.40 < 3.5.16.10
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.05% 0.787
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

https://www.codesys.com
Vendor Advisory
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13199&token=3e283c3e73fed61f7c181a7fa1169477efaf0c58&download=
Vendor Advisory
Mitigation
https://www.tenable.com/security/research/tra-2020-46
Third Party Advisory
Exploit