ICSA-21-173-03

CODESYS Control V2 communication

view advisory published 2021-06-22

Successful exploitation of these vulnerabilities may cause a heap-based buffer overflow, a stack-based buffer overflow, or a buffer over-read in the affected CODESYS products. This could result in a denial-of-service condition or allow remote code execution.

describes (3)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-30195US	high7.5	7.55% (94th)	—	2021-05-25
CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.
CVE-2021-30188US	critical9.8	1.27% (70th)	—	2021-05-25
CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.
CVE-2021-30186US	high7.5	7.74% (95th)	—	2021-05-25
CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.

references

External citations — patches, advisories, analysis.

ICS Advisory ICSA-21-173-03 JSONself
Recommended Practicesexternal
Recommended Practicesexternal
ICS Advisory ICSA-21-173-03 Web Versionself

remediations (12)

MitigationCODESYS PLCWinNT
Activate and apply user management and password features.
MitigationCODESYS PLCWinNT
Activate and apply user management and password features.
MitigationCODESYS PLCWinNT
Activate and apply user management and password features.
MitigationCODESYS Runtime Toolkit 32-bit full
Activate and apply user management and password features.
MitigationCODESYS Runtime Toolkit 32-bit full
Activate and apply user management and password features.
MitigationCODESYS Runtime Toolkit 32-bit full
Activate and apply user management and password features.
FixedCODESYS PLCWinNT
CODESYS GmbH has released the following product versions to solve the noted vulnerability issues for the affected CODESYS products: CODESYS Runtime Toolkit 32-bit full v2.4.7.55, CODESYS PLCWinNT v2.4.7.55. This will also be part of the CODESYS Development System setup v2.3.9.66
FixedCODESYS PLCWinNT
CODESYS GmbH has released the following product versions to solve the noted vulnerability issues for the affected CODESYS products: CODESYS Runtime Toolkit 32-bit full v2.4.7.55, CODESYS PLCWinNT v2.4.7.55. This will also be part of the CODESYS Development System setup v2.3.9.66
FixedCODESYS PLCWinNT
CODESYS GmbH has released the following product versions to solve the noted vulnerability issues for the affected CODESYS products: CODESYS Runtime Toolkit 32-bit full v2.4.7.55, CODESYS PLCWinNT v2.4.7.55. This will also be part of the CODESYS Development System setup v2.3.9.66
FixedCODESYS Runtime Toolkit 32-bit full
CODESYS GmbH has released the following product versions to solve the noted vulnerability issues for the affected CODESYS products: CODESYS Runtime Toolkit 32-bit full v2.4.7.55, CODESYS PLCWinNT v2.4.7.55. This will also be part of the CODESYS Development System setup v2.3.9.66
FixedCODESYS Runtime Toolkit 32-bit full
CODESYS GmbH has released the following product versions to solve the noted vulnerability issues for the affected CODESYS products: CODESYS Runtime Toolkit 32-bit full v2.4.7.55, CODESYS PLCWinNT v2.4.7.55. This will also be part of the CODESYS Development System setup v2.3.9.66
FixedCODESYS Runtime Toolkit 32-bit full
CODESYS GmbH has released the following product versions to solve the noted vulnerability issues for the affected CODESYS products: CODESYS Runtime Toolkit 32-bit full v2.4.7.55, CODESYS PLCWinNT v2.4.7.55. This will also be part of the CODESYS Development System setup v2.3.9.66

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan