CVE-2023-22424 is a use-after-free vulnerability in Kostac PLC Programming Software (formerly Koyo PLC Programming Software) versions 1.6.9.0 and earlier. This flaw allows an attacker to trigger memory access after it has been freed by providing an abnormal maximum number of columns in a PLC program. Rated 7.8 HIGH on the CVSS scale, this vulnerability requires user interaction (opening a specially crafted project file) and can lead to information disclosure and/or arbitrary code execution. There is currently no public exploit code available, it is not on CISA's KEV catalog, and community discussion and media coverage are minimal, suggesting low active exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.6.9.0CPE matchmatch criteria | cpe:2.3:a:jtekt:kostac_plc_programming_software:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.