CVE-2023-3663
Published: 03 August 2023
Summary
CVE-2023-3663 is a high-severity Improper Verification of Source of a Communication Channel (CWE-940) vulnerability in Codesys Development System. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 24.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-44307
Vulnerability details
In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Enforces verification of the source of a communication channel by requiring identification and authentication of services first.
Requires explicit verification of the source and integrity of the channel used for authentication and other security functions.
Provides the means to verify the source of name-resolution responses instead of relying on unauthenticated channels.
Requires explicit verification of the communication source, blocking session hijacking via spoofed or alternate channels.