ICSA-25-093-03: ABB ACS880 Drives Containing CODESYS RTS

Summary

Multiple vulnerabilities regarding the CODESYS Runtime System from CODESYS Group have been publicly reported. CODESYS Runtime System is utilized in the firmware of ABB ACS880 drives to provide IEC 61131-3 programming capabilities. These vulnerabilities could lead to out-of-bound memory access. Successful exploit may result in a denial-of-service condition or arbitrary code execution. Firmware updates are available that mitigate the publicly reported vulnerabilities of the product versions listed as affected in this advisory. CVE-2023-37559: After successful authentication as a user in multiple CODESYS products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. CVE-2023-37558: After successful authentication as a user in multiple CODESYS products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition.

Advisory Details CISA ICS CSAF feed

Advisory ID: ICSA-25-093-03
Status: Final · version 1.0.0
Initial release: 2025-03-26
Last revised: 2025-03-26
Vendor: ABB
Critical infrastructure sectors: Critical Manufacturing
Deployed: Worldwide
Vendor headquarters: Switzerland

Republished vendor advisory. This CISA CSAF advisory was converted from ABB PSIRT's CSAF advisory.

Mitigating factors: Network communication between attacker and drives is needed to exploit the vulnerabilities. Thus, network isolation or protection will make the attack difficult and less likely to succeed. Please refer to ‘General security recommendations for further advise on how to keep your system secure.

Workarounds: ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”. For situations where firmware update is not feasible, ABB recommends mitigating the threat by setting following parameters: For IGBT supply control program devices: set parameter 196.102 to bit 2 to disable file download (for further bit description, please refer to drive firmware manual ) For other devices: set parameter 96.102 to bit 2 to disable file download (for further bit description, please refer to drive firmware manuals) Impact of workaround: This workaround restricts IEC programs update, but existing IEC programs in Drives can still be used. To update an IEC program, the operator has to unlock the user lock and enable file download in a protected network environment. It is strongly recommended to disable file download. The vulnerabilities are exploitable when file download is enabled. Warning! – The user lock cannot be opened even by ABB if the pass code is lost.

Credit: ABB PSIRT

Affected products (4)

ACS880 Primary Control Program — <AINLX_v3.47, <YINLX_v1.30, >=AINLX_v3.47, >=YINLX_v1.30
ACS880 IGBT Supply Control Program — <AISLX_v3.43, <ALHLX_v3.43, <YISLX_v1.30, <YLHLX_v1.30, >=AISLX_v3.43, >=ALHLX_v3.43, >=YISLX_v1.30, >=YLHLX_v1.30
ACS880 Position Control Program — <=APCLX_v1.04.0.5, >APCLX_v1.04.0.5
ACS880 Test Bench Control Program — <=ATBLX_v3.44.0.0, >ATBLX_v3.44.0.0

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVE	Weakness	CVSS v3	Details
CVE-2022-4046	CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer	8.8 High	CVE-2022-4046 In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device. Vendor fix: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommen… Workaround: For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance Affected, fixed & timeline Affected: ACS880 Primary Control Program <AINLX_v3.47 ACS880 Primary Control Program <YINLX_v1.30 ACS880 IGBT Supply Control Program <AISLX_v3.43 ACS880 IGBT Supply Control Program <ALHLX_v3.43 ACS880 IGBT Supply Control Program <YISLX_v1.30 ACS880 IGBT Supply Control Program <YLHLX_v1.30 ACS880 Position Control Program <=APCLX_v1.04.0.5 ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0 Fixed in: ACS880 Primary Control Program >=AINLX_v3.47 ACS880 Primary Control Program >=YINLX_v1.30 ACS880 IGBT Supply Control Program >=AISLX_v3.43 ACS880 IGBT Supply Control Program >=ALHLX_v3.43 ACS880 IGBT Supply Control Program >=YISLX_v1.30 ACS880 IGBT Supply Control Program >=YLHLX_v1.30
CVE-2023-37545	CWE-20 Improper Input Validation	6.5 Medium	CVE-2023-37545 In multiple CODESYS products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. Vendor fix: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommen… Workaround: For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance Affected, fixed & timeline Affected: ACS880 Primary Control Program <AINLX_v3.47 ACS880 Primary Control Program <YINLX_v1.30 ACS880 IGBT Supply Control Program <AISLX_v3.43 ACS880 IGBT Supply Control Program <ALHLX_v3.43 ACS880 IGBT Supply Control Program <YISLX_v1.30 ACS880 IGBT Supply Control Program <YLHLX_v1.30 ACS880 Position Control Program <=APCLX_v1.04.0.5 ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0 Fixed in: ACS880 Primary Control Program >=AINLX_v3.47 ACS880 Primary Control Program >=YINLX_v1.30 ACS880 IGBT Supply Control Program >=AISLX_v3.43 ACS880 IGBT Supply Control Program >=ALHLX_v3.43 ACS880 IGBT Supply Control Program >=YISLX_v1.30 ACS880 IGBT Supply Control Program >=YLHLX_v1.30
CVE-2023-37546	CWE-20 Improper Input Validation	6.5 Medium	CVE-2023-37546 In multiple CODESYS products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. Vendor fix: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommen… Workaround: For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance Affected, fixed & timeline Affected: ACS880 Primary Control Program <AINLX_v3.47 ACS880 Primary Control Program <YINLX_v1.30 ACS880 IGBT Supply Control Program <AISLX_v3.43 ACS880 IGBT Supply Control Program <ALHLX_v3.43 ACS880 IGBT Supply Control Program <YISLX_v1.30 ACS880 IGBT Supply Control Program <YLHLX_v1.30 ACS880 Position Control Program <=APCLX_v1.04.0.5 ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0 Fixed in: ACS880 Primary Control Program >=AINLX_v3.47 ACS880 Primary Control Program >=YINLX_v1.30 ACS880 IGBT Supply Control Program >=AISLX_v3.43 ACS880 IGBT Supply Control Program >=ALHLX_v3.43 ACS880 IGBT Supply Control Program >=YISLX_v1.30 ACS880 IGBT Supply Control Program >=YLHLX_v1.30
CVE-2023-37547	CWE-20 Improper Input Validation	6.5 Medium	CVE-2023-37547 In multiple CODESYS products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. Vendor fix: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommen… Workaround: For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance Affected, fixed & timeline Affected: ACS880 Primary Control Program <AINLX_v3.47 ACS880 Primary Control Program <YINLX_v1.30 ACS880 IGBT Supply Control Program <AISLX_v3.43 ACS880 IGBT Supply Control Program <ALHLX_v3.43 ACS880 IGBT Supply Control Program <YISLX_v1.30 ACS880 IGBT Supply Control Program <YLHLX_v1.30 ACS880 Position Control Program <=APCLX_v1.04.0.5 ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0 Fixed in: ACS880 Primary Control Program >=AINLX_v3.47 ACS880 Primary Control Program >=YINLX_v1.30 ACS880 IGBT Supply Control Program >=AISLX_v3.43 ACS880 IGBT Supply Control Program >=ALHLX_v3.43 ACS880 IGBT Supply Control Program >=YISLX_v1.30 ACS880 IGBT Supply Control Program >=YLHLX_v1.30
CVE-2023-37548	CWE-20 Improper Input Validation	6.5 Medium	CVE-2023-37548 In multiple CODESYS products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. Vendor fix: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommen… Workaround: For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance Affected, fixed & timeline Affected: ACS880 Primary Control Program <AINLX_v3.47 ACS880 Primary Control Program <YINLX_v1.30 ACS880 IGBT Supply Control Program <AISLX_v3.43 ACS880 IGBT Supply Control Program <ALHLX_v3.43 ACS880 IGBT Supply Control Program <YISLX_v1.30 ACS880 IGBT Supply Control Program <YLHLX_v1.30 ACS880 Position Control Program <=APCLX_v1.04.0.5 ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0 Fixed in: ACS880 Primary Control Program >=AINLX_v3.47 ACS880 Primary Control Program >=YINLX_v1.30 ACS880 IGBT Supply Control Program >=AISLX_v3.43 ACS880 IGBT Supply Control Program >=ALHLX_v3.43 ACS880 IGBT Supply Control Program >=YISLX_v1.30 ACS880 IGBT Supply Control Program >=YLHLX_v1.30
CVE-2023-37549	CWE-20 Improper Input Validation	6.5 Medium	CVE-2023-37549 In multiple CODESYS products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. Vendor fix: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommen… Workaround: For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance Affected, fixed & timeline Affected: ACS880 Primary Control Program <AINLX_v3.47 ACS880 Primary Control Program <YINLX_v1.30 ACS880 IGBT Supply Control Program <AISLX_v3.43 ACS880 IGBT Supply Control Program <ALHLX_v3.43 ACS880 IGBT Supply Control Program <YISLX_v1.30 ACS880 IGBT Supply Control Program <YLHLX_v1.30 ACS880 Position Control Program <=APCLX_v1.04.0.5 ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0 Fixed in: ACS880 Primary Control Program >=AINLX_v3.47 ACS880 Primary Control Program >=YINLX_v1.30 ACS880 IGBT Supply Control Program >=AISLX_v3.43 ACS880 IGBT Supply Control Program >=ALHLX_v3.43 ACS880 IGBT Supply Control Program >=YISLX_v1.30 ACS880 IGBT Supply Control Program >=YLHLX_v1.30
CVE-2023-37550	CWE-20 Improper Input Validation	6.5 Medium	CVE-2023-37550 In multiple CODESYS products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. Vendor fix: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommen… Workaround: For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance Affected, fixed & timeline Affected: ACS880 Primary Control Program <AINLX_v3.47 ACS880 Primary Control Program <YINLX_v1.30 ACS880 IGBT Supply Control Program <AISLX_v3.43 ACS880 IGBT Supply Control Program <ALHLX_v3.43 ACS880 IGBT Supply Control Program <YISLX_v1.30 ACS880 IGBT Supply Control Program <YLHLX_v1.30 ACS880 Position Control Program <=APCLX_v1.04.0.5 ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0 Fixed in: ACS880 Primary Control Program >=AINLX_v3.47 ACS880 Primary Control Program >=YINLX_v1.30 ACS880 IGBT Supply Control Program >=AISLX_v3.43 ACS880 IGBT Supply Control Program >=ALHLX_v3.43 ACS880 IGBT Supply Control Program >=YISLX_v1.30 ACS880 IGBT Supply Control Program >=YLHLX_v1.30
CVE-2023-37552	CWE-20 Improper Input Validation	6.5 Medium	CVE-2023-37552 In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. Vendor fix: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommen… Workaround: For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance Affected, fixed & timeline Affected: ACS880 Primary Control Program <AINLX_v3.47 ACS880 Primary Control Program <YINLX_v1.30 ACS880 IGBT Supply Control Program <AISLX_v3.43 ACS880 IGBT Supply Control Program <ALHLX_v3.43 ACS880 IGBT Supply Control Program <YISLX_v1.30 ACS880 IGBT Supply Control Program <YLHLX_v1.30 ACS880 Position Control Program <=APCLX_v1.04.0.5 ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0 Fixed in: ACS880 Primary Control Program >=AINLX_v3.47 ACS880 Primary Control Program >=YINLX_v1.30 ACS880 IGBT Supply Control Program >=AISLX_v3.43 ACS880 IGBT Supply Control Program >=ALHLX_v3.43 ACS880 IGBT Supply Control Program >=YISLX_v1.30 ACS880 IGBT Supply Control Program >=YLHLX_v1.30
CVE-2023-37553	CWE-20 Improper Input Validation	6.5 Medium	CVE-2023-37553 In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. Vendor fix: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommen… Workaround: For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance Affected, fixed & timeline Affected: ACS880 Primary Control Program <AINLX_v3.47 ACS880 Primary Control Program <YINLX_v1.30 ACS880 IGBT Supply Control Program <AISLX_v3.43 ACS880 IGBT Supply Control Program <ALHLX_v3.43 ACS880 IGBT Supply Control Program <YISLX_v1.30 ACS880 IGBT Supply Control Program <YLHLX_v1.30 ACS880 Position Control Program <=APCLX_v1.04.0.5 ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0 Fixed in: ACS880 Primary Control Program >=AINLX_v3.47 ACS880 Primary Control Program >=YINLX_v1.30 ACS880 IGBT Supply Control Program >=AISLX_v3.43 ACS880 IGBT Supply Control Program >=ALHLX_v3.43 ACS880 IGBT Supply Control Program >=YISLX_v1.30 ACS880 IGBT Supply Control Program >=YLHLX_v1.30
CVE-2023-37554	CWE-20 Improper Input Validation	6.5 Medium	CVE-2023-37554 In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. Vendor fix: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommen… Workaround: For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance Affected, fixed & timeline Affected: ACS880 Primary Control Program <AINLX_v3.47 ACS880 Primary Control Program <YINLX_v1.30 ACS880 IGBT Supply Control Program <AISLX_v3.43 ACS880 IGBT Supply Control Program <ALHLX_v3.43 ACS880 IGBT Supply Control Program <YISLX_v1.30 ACS880 IGBT Supply Control Program <YLHLX_v1.30 ACS880 Position Control Program <=APCLX_v1.04.0.5 ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0 Fixed in: ACS880 Primary Control Program >=AINLX_v3.47 ACS880 Primary Control Program >=YINLX_v1.30 ACS880 IGBT Supply Control Program >=AISLX_v3.43 ACS880 IGBT Supply Control Program >=ALHLX_v3.43 ACS880 IGBT Supply Control Program >=YISLX_v1.30 ACS880 IGBT Supply Control Program >=YLHLX_v1.30
CVE-2023-37555	CWE-20 Improper Input Validation	6.5 Medium	CVE-2023-37555 In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. Vendor fix: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommen… Workaround: For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance Affected, fixed & timeline Affected: ACS880 Primary Control Program <AINLX_v3.47 ACS880 Primary Control Program <YINLX_v1.30 ACS880 IGBT Supply Control Program <AISLX_v3.43 ACS880 IGBT Supply Control Program <ALHLX_v3.43 ACS880 IGBT Supply Control Program <YISLX_v1.30 ACS880 IGBT Supply Control Program <YLHLX_v1.30 ACS880 Position Control Program <=APCLX_v1.04.0.5 ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0 Fixed in: ACS880 Primary Control Program >=AINLX_v3.47 ACS880 Primary Control Program >=YINLX_v1.30 ACS880 IGBT Supply Control Program >=AISLX_v3.43 ACS880 IGBT Supply Control Program >=ALHLX_v3.43 ACS880 IGBT Supply Control Program >=YISLX_v1.30 ACS880 IGBT Supply Control Program >=YLHLX_v1.30
CVE-2023-37556	CWE-20 Improper Input Validation	6.5 Medium	CVE-2023-37556 In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. Vendor fix: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommen… Workaround: For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance Affected, fixed & timeline Affected: ACS880 Primary Control Program <AINLX_v3.47 ACS880 Primary Control Program <YINLX_v1.30 ACS880 IGBT Supply Control Program <AISLX_v3.43 ACS880 IGBT Supply Control Program <ALHLX_v3.43 ACS880 IGBT Supply Control Program <YISLX_v1.30 ACS880 IGBT Supply Control Program <YLHLX_v1.30 ACS880 Position Control Program <=APCLX_v1.04.0.5 ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0 Fixed in: ACS880 Primary Control Program >=AINLX_v3.47 ACS880 Primary Control Program >=YINLX_v1.30 ACS880 IGBT Supply Control Program >=AISLX_v3.43 ACS880 IGBT Supply Control Program >=ALHLX_v3.43 ACS880 IGBT Supply Control Program >=YISLX_v1.30 ACS880 IGBT Supply Control Program >=YLHLX_v1.30
CVE-2023-37557	CWE-787 Out-of-bounds Write	6.5 Medium	CVE-2023-37557 After successful authentication as a user in multiple CODESYS products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition Vendor fix: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommen… Workaround: For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance Affected, fixed & timeline Affected: ACS880 Primary Control Program <AINLX_v3.47 ACS880 Primary Control Program <YINLX_v1.30 ACS880 IGBT Supply Control Program <AISLX_v3.43 ACS880 IGBT Supply Control Program <ALHLX_v3.43 ACS880 IGBT Supply Control Program <YISLX_v1.30 ACS880 IGBT Supply Control Program <YLHLX_v1.30 ACS880 Position Control Program <=APCLX_v1.04.0.5 ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0 Fixed in: ACS880 Primary Control Program >=AINLX_v3.47 ACS880 Primary Control Program >=YINLX_v1.30 ACS880 IGBT Supply Control Program >=AISLX_v3.43 ACS880 IGBT Supply Control Program >=ALHLX_v3.43 ACS880 IGBT Supply Control Program >=YISLX_v1.30 ACS880 IGBT Supply Control Program >=YLHLX_v1.30
CVE-2023-37558	CWE-20 Improper Input Validation	6.5 Medium	CVE-2023-37558 After successful authentication as a user in multiple CODESYS products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. Vendor fix: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommen… Workaround: For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance Affected, fixed & timeline Affected: ACS880 Primary Control Program <AINLX_v3.47 ACS880 Primary Control Program <YINLX_v1.30 ACS880 IGBT Supply Control Program <AISLX_v3.43 ACS880 IGBT Supply Control Program <ALHLX_v3.43 ACS880 IGBT Supply Control Program <YISLX_v1.30 ACS880 IGBT Supply Control Program <YLHLX_v1.30 ACS880 Position Control Program <=APCLX_v1.04.0.5 ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0 Fixed in: ACS880 Primary Control Program >=AINLX_v3.47 ACS880 Primary Control Program >=YINLX_v1.30 ACS880 IGBT Supply Control Program >=AISLX_v3.43 ACS880 IGBT Supply Control Program >=ALHLX_v3.43 ACS880 IGBT Supply Control Program >=YISLX_v1.30 ACS880 IGBT Supply Control Program >=YLHLX_v1.30
CVE-2023-37559	CWE-20 Improper Input Validation	6.5 Medium	CVE-2023-37559 After successful authentication as a user in multiple CODESYS products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. Vendor fix: In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommen… Workaround: For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance Affected, fixed & timeline Affected: ACS880 Primary Control Program <AINLX_v3.47 ACS880 Primary Control Program <YINLX_v1.30 ACS880 IGBT Supply Control Program <AISLX_v3.43 ACS880 IGBT Supply Control Program <ALHLX_v3.43 ACS880 IGBT Supply Control Program <YISLX_v1.30 ACS880 IGBT Supply Control Program <YLHLX_v1.30 ACS880 Position Control Program <=APCLX_v1.04.0.5 ACS880 Test Bench Control Program <=ATBLX_v3.44.0.0 Fixed in: ACS880 Primary Control Program >=AINLX_v3.47 ACS880 Primary Control Program >=YINLX_v1.30 ACS880 IGBT Supply Control Program >=AISLX_v3.43 ACS880 IGBT Supply Control Program >=ALHLX_v3.43 ACS880 IGBT Supply Control Program >=YISLX_v1.30 ACS880 IGBT Supply Control Program >=YLHLX_v1.30

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2022-4046	8.8 High	CODESYS CODESYS Control for BeagleBone SL In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user …
CVE-2023-37545	6.5 Medium	CODESYS CODESYS Control for BeagleBone SL In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with in…
CVE-2023-37546	6.5 Medium	CODESYS CODESYS Control for BeagleBone SL In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with in…
CVE-2023-37547	6.5 Medium	CODESYS CODESYS Control for BeagleBone SL In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with in…
CVE-2023-37548	6.5 Medium	CODESYS CODESYS Control for BeagleBone SL In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with in…
CVE-2023-37549	6.5 Medium	CODESYS CODESYS Control for BeagleBone SL In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with in…
CVE-2023-37550	6.5 Medium	CODESYS CODESYS Control for BeagleBone SL In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with in…
CVE-2023-37552	6.5 Medium	CODESYS CODESYS Control for BeagleBone SL In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with in…
CVE-2023-37553	6.5 Medium	CODESYS CODESYS Control for BeagleBone SL In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with in…
CVE-2023-37554	6.5 Medium	CODESYS CODESYS Control for BeagleBone SL In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with in…
CVE-2023-37555	6.5 Medium	CODESYS CODESYS Control for BeagleBone SL In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with in…
CVE-2023-37556	6.5 Medium	CODESYS CODESYS Control for BeagleBone SL In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with in…
CVE-2023-37557	6.5 Medium	CODESYS CODESYS Control for BeagleBone SL After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause…
CVE-2023-37558	6.5 Medium	CODESYS CODESYS Control for BeagleBone SL After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inc…
CVE-2023-37559	6.5 Medium	CODESYS CODESYS Control for BeagleBone SL After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inc…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.

CyberzSOC