What’s Vulnerable › Vulnerabilities
CVE-2019-13548
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 5.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-09-13 · updated 2026-06-17
- Weakness: CWE-121
Description
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow and create a denial-of-service condition or allow remote code execution.
Affected products
- CODESYS Control for BeagleBone: before 3.5.14.10 — fixed in 3.5.14.10
- CODESYS Control For Empc-A/Imx6: before 3.5.14.10 — fixed in 3.5.14.10
- CODESYS Control for IOT2000: before 3.5.14.10 — fixed in 3.5.14.10
- CODESYS Control For Linux: before 3.5.14.10 — fixed in 3.5.14.10
- CODESYS Control for PFC100: before 3.5.14.10 — fixed in 3.5.14.10
- CODESYS Control for PFC200: before 3.5.14.10 — fixed in 3.5.14.10
- CODESYS Control for Raspberry Pi: before 3.5.14.10 — fixed in 3.5.14.10
- CODESYS Control Rte: from 3.5.8.60 before 3.5.12.80; from 3.5.13.0 before 3.5.14.10 — fixed in 3.5.12.80, 3.5.14.10
- CODESYS Control Runtime System Toolkit: from 3.0 before 3.5.12.80 — fixed in 3.5.12.80
- CODESYS Control Win: from 3.5.9.80 through 3.5.12.80; from 3.5.13.0 before 3.5.14.10 — fixed in 3.5.14.10
- CODESYS Embedded Target Visu Toolkit: from 3.0 before 3.5.12.80 — fixed in 3.5.12.80
- CODESYS Hmi: from 3.5.10.0 before 3.5.12.80; from 3.5.13.0 before 3.5.14.10 — fixed in 3.5.12.80, 3.5.14.10
- CODESYS Remote Target Visu Toolkit: from 3.0 before 3.5.12.80 — fixed in 3.5.12.80
How to fix
Upgrade to a fixed version: CODESYS Control for BeagleBone 3.5.14.10; CODESYS Control For Empc-A/Imx6 3.5.14.10; CODESYS Control for IOT2000 3.5.14.10; CODESYS Control For Linux 3.5.14.10; CODESYS Control for PFC100 3.5.14.10; CODESYS Control for PFC200 3.5.14.10; CODESYS Control for Raspberry Pi 3.5.14.10; CODESYS Control Rte 3.5.12.80, 3.5.14.10; CODESYS Control Runtime System Toolkit 3.5.12.80; CODESYS Control Win 3.5.14.10; CODESYS Embedded Target Visu Toolkit 3.5.12.80; CODESYS Hmi 3.5.12.80, 3.5.14.10. Check the vendor advisory for mitigations.
References
- https://www.us-cert.gov/ics/advisories/icsa-19-255-01
- https://www.us-cert.gov/ics/advisories/icsa-19-255-01
Get alerted when CVE-2019-13548 or the next vulnerability affects your stack