CODESYS: CODESYS web server vulnerable to DoS
The CODESYS web server component of the CODESYS Control runtime system is used by the CODESYS WebVisu to display visualization screens in a web browser. Receiving a specifically crafted TLS packet on an HTTPS connection causes the CODESYS web server to crash because the return value of an underlying function is not checked correctly for such unusual conditions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-8175US | — | — | ||
An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS. | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- Fixed
Update the following products to version 3.5.20.30. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS HMI (SL) * CODESYS Runtime Toolkit * CODESYS Embedded Target Visu Toolkit * CODESYS Remote Target Visu Toolkit The products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS download area.
- FixedControl for IOT2000 SL
Update the following product to version 4.15.0.0 (Version 4.14.0.0 has not been released). * CODESYS Control for IOT2000 SL The products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS download area.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan