CVE-2024-5000 CODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA products
An unauthenticated remote attacker can cause a denial of service on CODESYS OPC UA products by sending a crafted request that triggers a buffer size calculation error.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-5000?
CVE-2024-5000 is a high-severity denial of service vulnerability in CODESYS Control RTE (SL), published on 4 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.
Weakness: CWE-131
Which versions are affected by CVE-2024-5000?
How do I fix CVE-2024-5000?
No fix has been published for CVE-2024-5000 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-5000 being exploited?
There is no known exploitation of CVE-2024-5000 in the wild and no public exploit code.
Sources
Also known as GHSA-xchm-28cx-p56h.