WAGO: Multiple products prone to multiple vulnerabilities in e!Runtime / CODESYS V3 Runtime
Multiple WAGO devices are prone to vulnerabilites in the used CODESYS V3 framework.
describes (16)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-47393US | — | — | ||
An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products… | ||||
| CVE-2022-47392US | — | — | ||
An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions… | ||||
| CVE-2022-47391US | — | — | ||
In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a den… | ||||
| CVE-2022-47390US | high8.8 | — | ||
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write da… | ||||
| CVE-2022-47389US | — | — | ||
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write da… | ||||
| CVE-2022-47388US | — | — | ||
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write da… | ||||
| CVE-2022-47387US | — | — | ||
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write dat… | ||||
| CVE-2022-47386US | — | — | ||
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write da… | ||||
| CVE-2022-47385US | — | — | ||
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple versions to write da… | ||||
| CVE-2022-47384US | — | — | ||
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write dat… | ||||
| CVE-2022-47383US | — | — | ||
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write da… | ||||
| CVE-2022-47382US | — | — | ||
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write dat… | ||||
| CVE-2022-47381US | — | — | ||
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can le… | ||||
| CVE-2022-47380US | — | — | ||
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can l… | ||||
| CVE-2022-47379US | — | — | ||
An authenticated, remote attacker may use a out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into memory which can lead to a denial… | ||||
| CVE-2022-47378US | medium6.5 | — | ||
Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vul… | ||||
references
External citations — patches, advisories, analysis.
- VDE-2023-026: WAGO: Multiple products prone to multiple vulnerabilities in e!Runtime / CODESYS V3 Runtime - HTMLself
- CERT@VDE Security Advisories for WAGO GmbH & Co. KGexternal
- VDE-2023-026: WAGO: Multiple products prone to multiple vulnerabilities in e!Runtime / CODESYS V3 Runtime - CSAFself
- WAGO PSIRTexternal
remediations (32)
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Mitigation
Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
- Fixed
A fixed firmware for affected devices is planned for Q1 2024.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan