ABB ACS880 +N8010 Drives CODESYS RTS Vulnerabilities
Multiple vulnerabilities regarding the CODESYS Runtime System from CODESYS Group have been publicly reported. CODESYS Runtime System is utilized in the firmware of ABB ACS880 drives to provide IEC 61131-3 programming capabilities. These vulnerabilities could lead to out-of-bound memory access. Successful exploit may result in a denial-of-service condition or arbitrary code execution. Firmware updates are available that mitigate the publicly reported vulnerabilities of the product versions listed as affected in this advisory.
describes (15)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-4046US | — | — | ||
In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access… | ||||
| CVE-2023-37559US | — | — | ||
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the… | ||||
| CVE-2023-37558US | — | — | ||
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the… | ||||
| CVE-2023-37557US | — | — | ||
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to over… | ||||
| CVE-2023-37556US | — | — | ||
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37555US | — | — | ||
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37554US | — | — | ||
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37553US | — | — | ||
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37552US | medium6.5 | — | ||
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37550US | — | — | ||
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37549US | — | — | ||
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37548US | — | — | ||
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37547US | — | — | ||
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37546US | — | — | ||
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
| CVE-2023-37545US | — | — | ||
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause th… | ||||
references
External citations — patches, advisories, analysis.
- CODESYS Security Advisory 2023-04
- CODESYS Security Advisory 2023-05
- https://global.abb/group/en/media/resources/glossary
- ACS880 primary control program (AINLX) Firmware manual
- ACS880 primary control program (YINLX) Firmware manual
- ACS880 IGBT supply control program (YISLX and YLHLX) firmware manual
- https://new.abb.com/drives/what-is-a-variable-speed-drive
- ABB CYBERSECURITY ADVISORY - CSAF versionself
remediations (60)
- FixedACS880 IGBT Supply Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 IGBT Supply Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 IGBT Supply Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 IGBT Supply Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 IGBT Supply Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 IGBT Supply Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 IGBT Supply Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 IGBT Supply Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 IGBT Supply Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 IGBT Supply Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 IGBT Supply Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 IGBT Supply Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 IGBT Supply Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 IGBT Supply Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 IGBT Supply Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 Primary Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 Primary Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 Primary Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 Primary Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 Primary Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 Primary Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 Primary Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 Primary Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 Primary Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 Primary Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 Primary Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 Primary Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 Primary Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 Primary Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- FixedACS880 Primary Control Program
In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Position Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Position Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Position Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Position Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Position Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Position Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Position Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Position Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Position Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Position Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Position Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Position Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Position Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Position Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Position Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Test Bench Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Test Bench Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Test Bench Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Test Bench Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Test Bench Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Test Bench Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Test Bench Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Test Bench Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Test Bench Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Test Bench Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Test Bench Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Test Bench Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Test Bench Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Test Bench Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
- WorkaroundACS880 Test Bench Control Program
For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan