CVE-2023-3662: 
CODESYS Development System vulnerability analysis and mitigation

CVE-2023-3662 affects the CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20. The vulnerability was discovered in August 2023 and allows for execution of binaries from the current working directory in the user's context (VDE Advisory).

The vulnerability is classified as an Uncontrolled Search Path Element (CWE-427) with a CVSS v3.1 base score of 7.3 HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). The vulnerability requires local access and user interaction to be exploited (CISA Advisory, VDE Advisory).

Successful exploitation of this vulnerability could allow attackers to cause users to unknowingly launch a malicious binary placed by a local attacker. This could potentially lead to complete compromise of the affected system with the privileges of the user (CISA Advisory).

CODESYS recommends users update the CODESYS Development System to version 3.5.19.20. The update can be obtained through the CODESYS Installer or downloaded from the CODESYS Store. Users should also exercise principles of least privilege to minimize the risk of exploitation (CISA Advisory, VDE Advisory).