CVE-2019-13542

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-17 · updated 2026-06-17
Weakness: CWE-476

Description

3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send crafted requests from a trusted OPC UA client that cause a NULL pointer dereference, which may trigger a denial-of-service condition.

Affected products

CODESYS Control for BeagleBone: from 3.5.11.0 before 3.5.15.0 — fixed in 3.5.15.0
CODESYS Control For Empc-A/Imx6: from 3.5.11.0 before 3.5.15.0 — fixed in 3.5.15.0
CODESYS Control for IOT2000: from 3.5.11.0 before 3.5.15.0 — fixed in 3.5.15.0
CODESYS Control for PFC100: from 3.5.11.0 before 3.5.15.0 — fixed in 3.5.15.0
CODESYS Control for PFC200: from 3.5.11.0 before 3.5.15.0 — fixed in 3.5.15.0
CODESYS Control for Raspberry Pi: from 3.5.11.0 before 3.5.15.0 — fixed in 3.5.15.0
CODESYS Control Rte: from 3.5.11.0 before 3.5.15.0 — fixed in 3.5.15.0
CODESYS Control Win: from 3.5.11.0 before 3.5.15.0 — fixed in 3.5.15.0
CODESYS Linux: from 3.5.11.0 before 3.5.15.0 — fixed in 3.5.15.0
CODESYS Runtime System Toolkit: from 3.5.11.0 before 3.5.15.0 — fixed in 3.5.15.0

How to fix

Upgrade to a fixed version: CODESYS Control for BeagleBone 3.5.15.0; CODESYS Control For Empc-A/Imx6 3.5.15.0; CODESYS Control for IOT2000 3.5.15.0; CODESYS Control for PFC100 3.5.15.0; CODESYS Control for PFC200 3.5.15.0; CODESYS Control for Raspberry Pi 3.5.15.0; CODESYS Control Rte 3.5.15.0; CODESYS Control Win 3.5.15.0; CODESYS Linux 3.5.15.0; CODESYS Runtime System Toolkit 3.5.15.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-13542 or the next vulnerability affects your stack