{"api_version":"1","generated_at":"2026-04-24T20:16:30+00:00","cve":"CVE-2023-3670","urls":{"html":"https://cve.report/CVE-2023-3670","api":"https://cve.report/api/cve/CVE-2023-3670.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-3670","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-3670"},"summary":{"title":"CVE-2023-3670","description":"In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.","state":"PUBLIC","assigner":"info@cert.vde.com","published_at":"2023-07-28 08:15:00","updated_at":"2023-08-03 18:44:00"},"problem_types":["CWE-668"],"metrics":[],"references":[{"url":"https://cert.vde.com/en/advisories/VDE-2023-024","name":"https://cert.vde.com/en/advisories/VDE-2023-024","refsource":"MISC","tags":[],"title":"VDE-2023-024 | CERT@VDE","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3670","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3670","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"3670","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"codesys","cpe5":"development_system","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"3670","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"codesys","cpe5":"scripting","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2023-3670","ASSIGNER":"info@cert.vde.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-668 Exposure of Resource to Wrong Sphere","cweId":"CWE-668"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"CODESYS","product":{"product_data":[{"product_name":"CODESYS Development System","version":{"version_data":[{"version_affected":"<","version_name":"3.5.9.0","version_value":"3.5.17.0"}]}},{"product_name":"CODESYS Scripting","version":{"version_data":[{"version_affected":"<","version_name":"4.0.0.0","version_value":"4.1.0.0"}]}}]}}]}},"references":{"reference_data":[{"url":"https://cert.vde.com/en/advisories/VDE-2023-024","refsource":"MISC","name":"https://cert.vde.com/en/advisories/VDE-2023-024"}]},"generator":{"engine":"Vulnogram 0.1.0-dev"},"source":{"advisory":"VDE-2023-024","defect":["CERT@VDE#64563"],"discovery":"UNKNOWN"},"impact":{"cvss":[{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}]}},"nvd":{"publishedDate":"2023-07-28 08:15:00","lastModifiedDate":"2023-08-03 18:44:00","problem_types":["CWE-668"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH"},"exploitabilityScore":1.3,"impactScore":5.9}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:codesys:scripting:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0.0","versionEndExcluding":"4.1.0.0","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*","versionStartIncluding":"3.5.9.0","versionEndExcluding":"3.5.17.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}