VDB
ICSA-25-182-03
ICSA-25-182-03
PUBLISHED
CVSS 9.800000190734863 CRITICAL
An unauthenticated attacker would be able to send crafted requests to cause the CODESYS Gateway Server V2 to allocate excessive memory or consume all available TCP client connections. Besides, passwords are insufficiently checked during login. All versions of the following CODESYS V2 product prior version V2.3.9.38 are affected: • CODESYS Gateway Server
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| CODESYS provided by Festo all versions |
Timeline
- Dec 3, 2024 CVE Published
References
- https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2024/fsa-202406.json advisory
- https://certvde.com/en/advisories/vendor/festo/ url
- https://festo.com/psirt url
- https://certvde.com/en/advisories/VDE-2024-059 advisory
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-182-03.json advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-03 advisory
- https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01 url
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices url
- https://www.cisa.gov/topics/industrial-control-systems url
- https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf url
- https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf url
- https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B url