Details of VAR-202007-0686

ID

VAR-202007-0686

CVE

CVE-2020-15806

TITLE

CODESYS Control Vulnerability in resource allocation without restrictions or throttling in

Trust: 0.8

sources: JVNDB: JVNDB-2020-008192

DESCRIPTION

CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation. CODESYS Control Is vulnerable to resource allocation without restrictions or throttling.Service operation interruption (DoS) It may be put into a state. 3S-Smart Software Solutions CODESYS Control is a set of industrial control program programming software. 3S-Smart Software Solutions CODESYS Control has a denial of service vulnerability. Allow remote attackers to use vulnerabilities to submit special requests and perform denial of service attacks

Trust: 2.16

sources: NVD: CVE-2020-15806 // JVNDB: JVNDB-2020-008192 // CNVD: CNVD-2020-53803

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-53803

AFFECTED PRODUCTS

vendor:	codesys	model:	simulation runtime	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	codesys	model:	simulation runtime	scope:	gte	version:	3.5.9.40	Trust: 1.0
vendor:	codesys	model:	control runtime system toolkit	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	codesys	model:	control for iot2000	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	codesys	model:	control for beaglebone	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	codesys	model:	control runtime system toolkit	scope:	gte	version:	3.0	Trust: 1.0
vendor:	codesys	model:	control for pfc200	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	codesys	model:	control win	scope:	gte	version:	3.5.9.80	Trust: 1.0
vendor:	codesys	model:	control rte	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	codesys	model:	hmi	scope:	gte	version:	3.5.10.0	Trust: 1.0
vendor:	codesys	model:	control for plcnext	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	codesys	model:	embedded target visu toolkit	scope:	gte	version:	3.0	Trust: 1.0
vendor:	codesys	model:	control for wago touch panels 600	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	codesys	model:	embedded target visu toolkit	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	codesys	model:	control for linux	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	codesys	model:	remote target visu toolkit	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	codesys	model:	control for empc-a\/imx6	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	codesys	model:	hmi	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	codesys	model:	control for raspberry pi	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	codesys	model:	remote target visu toolkit	scope:	gte	version:	3.0	Trust: 1.0
vendor:	codesys	model:	control rte	scope:	gte	version:	3.5.8.60	Trust: 1.0
vendor:	codesys	model:	control for pfc100	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	codesys	model:	control win	scope:	lt	version:	3.5.16.10	Trust: 1.0
vendor:	3s smart	model:	codesys control for beaglebone	scope:	-	version:	-	Trust: 0.8
vendor:	3s smart	model:	codesys control for empc-a/imx6	scope:	-	version:	-	Trust: 0.8
vendor:	3s smart	model:	codesys control for iot2000	scope:	-	version:	-	Trust: 0.8
vendor:	3s smart	model:	codesys control for linux	scope:	-	version:	-	Trust: 0.8
vendor:	3s smart	model:	codesys control for pfc100	scope:	-	version:	-	Trust: 0.8
vendor:	3s smart	model:	codesys control for pfc200	scope:	-	version:	-	Trust: 0.8
vendor:	3s smart	model:	codesys control for plcnext	scope:	-	version:	-	Trust: 0.8
vendor:	3s smart	model:	codesys control for raspberry pi	scope:	-	version:	-	Trust: 0.8
vendor:	3s smart	model:	codesys control for wago touch panels 600	scope:	-	version:	-	Trust: 0.8
vendor:	3s smart	model:	codesys control rte v3	scope:	-	version:	-	Trust: 0.8
vendor:	3s smart	model:	software solutions codesys control runtime system	scope:	lt	version:	3.5.16.10	Trust: 0.6

sources: CNVD: CNVD-2020-53803 // JVNDB: JVNDB-2020-008192 // NVD: CVE-2020-15806

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-15806
value:	HIGH
Trust: 1.0
NVD:	JVNDB-2020-008192
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2020-53803
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202007-1373
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2020-15806
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2020-008192
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-53803
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2020-15806
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	JVNDB-2020-008192
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-53803 // JVNDB: JVNDB-2020-008192 // CNNVD: CNNVD-202007-1373 // NVD: CVE-2020-15806

PROBLEMTYPE DATA

problemtype:	CWE-401	Trust: 1.0
problemtype:	CWE-770	Trust: 0.8

sources: JVNDB: JVNDB-2020-008192 // NVD: CVE-2020-15806

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202007-1373

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202007-1373

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-008192

PATCH

title:	Top Page	url:	https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13199&token=3e283c3e73fed61f7c181a7fa1169477efaf0c58&download=	Trust: 0.8
title:	CODESYS GroupAdvisory 2020-05	url:	https://www.codesys.com	Trust: 0.8
title:	Patch for 3S-Smart Software Solutions CODESYS Control Denial of Service Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/235513	Trust: 0.6
title:	3S-Smart Software Solutions CODESYS Control Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=125016	Trust: 0.6

sources: CNVD: CNVD-2020-53803 // JVNDB: JVNDB-2020-008192 // CNNVD: CNNVD-202007-1373

EXTERNAL IDS

db:	NVD	id:	CVE-2020-15806	Trust: 3.0
db:	TENABLE	id:	TRA-2020-46	Trust: 1.6
db:	JVNDB	id:	JVNDB-2020-008192	Trust: 0.8
db:	CNVD	id:	CNVD-2020-53803	Trust: 0.6
db:	CNNVD	id:	CNNVD-202007-1373	Trust: 0.6

sources: CNVD: CNVD-2020-53803 // JVNDB: JVNDB-2020-008192 // CNNVD: CNNVD-202007-1373 // NVD: CVE-2020-15806

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2020-15806	Trust: 2.0
url:	https://customers.codesys.com/index.php?eid=dumpfile&t=f&f=13199&token=3e283c3e73fed61f7c181a7fa1169477efaf0c58&download=	Trust: 1.6
url:	https://www.codesys.com	Trust: 1.6
url:	https://www.tenable.com/security/research/tra-2020-46	Trust: 1.6
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-15806	Trust: 0.8

sources: CNVD: CNVD-2020-53803 // JVNDB: JVNDB-2020-008192 // CNNVD: CNNVD-202007-1373 // NVD: CVE-2020-15806

SOURCES

db:	CNVD	id:	CNVD-2020-53803
db:	JVNDB	id:	JVNDB-2020-008192
db:	CNNVD	id:	CNNVD-202007-1373
db:	NVD	id:	CVE-2020-15806

LAST UPDATE DATE

2024-11-23T22:33:24.506000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-53803	date:	2020-09-24T00:00:00
db:	JVNDB	id:	JVNDB-2020-008192	date:	2020-09-04T00:00:00
db:	CNNVD	id:	CNNVD-202007-1373	date:	2020-07-27T00:00:00
db:	NVD	id:	CVE-2020-15806	date:	2024-11-21T05:06:13.097

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-53803	date:	2020-09-24T00:00:00
db:	JVNDB	id:	JVNDB-2020-008192	date:	2020-09-04T00:00:00
db:	CNNVD	id:	CNNVD-202007-1373	date:	2020-07-22T00:00:00
db:	NVD	id:	CVE-2020-15806	date:	2020-07-22T19:15:12.317