What’s Vulnerable › Vulnerabilities
CVE-2019-9012
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-08-15 · updated 2026-06-17
- Weakness: CWE-770
Description
An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products and may result in a denial-of-service condition. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.
Affected products
- CODESYS Control for BeagleBone SL: from 3.0 before 3.5.14.20 — fixed in 3.5.14.20
- CODESYS Control For Empc-A/Imx6 Sl: from 3.0 before 3.5.14.20 — fixed in 3.5.14.20
- CODESYS Control for IOT2000 SL: from 3.0 before 3.5.14.20 — fixed in 3.5.14.20
- CODESYS Control for Linux SL: from 3.0 before 3.5.14.20 — fixed in 3.5.14.20
- CODESYS Control for PFC100 SL: from 3.0 before 3.5.14.20 — fixed in 3.5.14.20
- CODESYS Control for PFC200 SL: from 3.0 before 3.5.14.20 — fixed in 3.5.14.20
- CODESYS Control for Raspberry Pi SL: from 3.0 before 3.5.14.20 — fixed in 3.5.14.20
- CODESYS Control Runtime Toolkit: from 3.0 before 3.5.14.20 — fixed in 3.5.14.20
- CODESYS Development System: from 3.0 before 3.5.14.20 — fixed in 3.5.14.20
- CODESYS Gateway Server V2: from 3.0 before 3.5.14.20 — fixed in 3.5.14.20
How to fix
Upgrade to a fixed version: CODESYS Control for BeagleBone SL 3.5.14.20; CODESYS Control For Empc-A/Imx6 Sl 3.5.14.20; CODESYS Control for IOT2000 SL 3.5.14.20; CODESYS Control for Linux SL 3.5.14.20; CODESYS Control for PFC100 SL 3.5.14.20; CODESYS Control for PFC200 SL 3.5.14.20; CODESYS Control for Raspberry Pi SL 3.5.14.20; CODESYS Control Runtime Toolkit 3.5.14.20; CODESYS Development System 3.5.14.20; CODESYS Gateway Server V2 3.5.14.20. Check the vendor advisory for mitigations.
References
- https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12938&token=b9eb30f53246dc57b2e7cb302356a05547148fa2&download=
- https://www.us-cert.gov/ics/advisories/icsa-19-213-03
- https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12938&token=b9eb30f53246dc57b2e7cb302356a05547148fa2&download=
- https://www.us-cert.gov/ics/advisories/icsa-19-213-03
Get alerted when CVE-2019-9012 or the next vulnerability affects your stack