Summary
This document is a security advisory detailing a vulnerability affecting multiple CODESYS products, specifically versions prior to 3.5.20.10. It outlines that legitimate local Microsoft Windows users can read or modify files in the working directory of the affected products, which include CODESYS Control Win, CODESYS Edge Gateway for Windows, and CODESYS Development System V3, among others. The advisory provides vulnerability identifiers, including CVE-2023-5751, and a CVSS v3.1 base score of 7.8, indicating a high severity level. The document also discusses the impact of the vulnerability, emphasizing the need for users to update to version 3.5.20.10 to mitigate risks. Recommendations for general security practices are included, such as using firewalls, managing user access, and employing encrypted communication. The advisory concludes with acknowledgments and a disclaimer regarding liability.
