CVE-2015-6460

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-09-18 · updated 2026-06-17
Weakness: CWE-119

Description

Multiple heap-based buffer overflows in 3S-Smart CODESYS Gateway Server before 2.3.9.34 allow remote attackers to execute arbitrary code via opcode (1) 0x3ef or (2) 0x3f0.

Affected products

CODESYS 3S-Smart CODESYS Gateway Server: before 2.3.9.34 — fixed in 2.3.9.34

How to fix

Upgrade to a fixed version: CODESYS 3S-Smart CODESYS Gateway Server 2.3.9.34. Check the vendor advisory for mitigations.

References

http://zerodayinitiative.com/advisories/ZDI-15-441/
http://zerodayinitiative.com/advisories/ZDI-15-442/
https://ics-cert.us-cert.gov/advisories/ICSA-15-258-02
http://zerodayinitiative.com/advisories/ZDI-15-441/
http://zerodayinitiative.com/advisories/ZDI-15-442/
https://ics-cert.us-cert.gov/advisories/ICSA-15-258-02

Get alerted when CVE-2015-6460 or the next vulnerability affects your stack