CVE-2019-13548
9.8
CRITICAL · CVSS 3.1 · EPSS 5.8% (pctl 93)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow and create a denial-of-service condition or allow remote code execution.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 5.81% — more likely to be exploited than 93% of all CVEs |
| Weakness | CWE-121 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2019-09-13 |
| Last modified | 2026-06-17 |
Affected (13)
| Vendor | Product |
|---|---|
| codesys | control for beaglebone |
| codesys | control for empc-a\/imx6 |
| codesys | control for iot2000 |
| codesys | control for linux |
| codesys | control for pfc100 |
| codesys | control for pfc200 |
| codesys | control for raspberry pi |
| codesys | control rte |
| codesys | control runtime system toolkit |
| codesys | control win |
| codesys | embedded target visu toolkit |
| codesys | hmi |
| codesys | remote target visu toolkit |
References
→ the Explorer · watch your stack · NVD