CVE-2024-5000 is a denial-of-service vulnerability affecting CODESYS products, where an unauthenticated remote attacker can crash the system by sending a malformed OPC UA request due to an incorrect buffer size calculation. With a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network with low attack complexity, leading to a complete loss of availability. There is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not known to be actively exploited in the wild, though it has garnered some community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| CODESYS | CODESYS Control RTE (SL) | >= 0, < 3.5.20.10CNA affecteddefault unaffected | |
| CODESYS | CODESYS Control RTE (For Beckhoff CX) SL | >= 0, < 3.5.20.10CNA affecteddefault unaffected | |
| CODESYS | CODESYS Control Win (SL) | >= 0, < 3.5.20.10CNA affecteddefault unaffected | |
| CODESYS | CODESYS Control For BeagleBone SL | >= 0, < 4.12.0.0CNA affecteddefault unaffected | |
| CODESYS | CODESYS Control For IOT2000 SL | >= 0, < 4.12.0.0CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.