CVE-2019-13548 - CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow and create a denial-of-service condition or allow remote code execution

Back Back to CVE browser

CRITICAL

CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow and create a denial-of-service condition or allow remote code execution

Published Sep 13, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 5.81%

Description

CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow and create a denial-of-service condition or allow remote code execution.

Affected products

Vendor n/a Product CODESYS V3 web server Default
n/a
- Version
  all versions prior to 3.5.14.10
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

CODESYS V3 web server

n/a

Version	Status	Constraints
all versions prior to 3.5.14.10	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-121

CWE-787

Out-of-bounds Write

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-5003
Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-255-01
x_refsource_MISCMitigationPatchThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-5003		Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-255-01		x_refsource_MISCMitigationPatchThird Party AdvisoryUS Government Resource