CODESYS Key physical side-channel vulnerability
The CODESYS Key USB dongle, which is based on WIBU CodeMeter technology, is affected by a physical side-channel vulnerability.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-45678US | medium4.2 | — | ||
Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical acce… | ||||
references
External citations — patches, advisories, analysis.
- Advisory2025-01_VDE-2025-001: CODESYS Key physical side-channel vulnerability - HTMLself
- CERT@VDE Security Advisories for CODESYS GmbHexternal
- Advisory2025-01_VDE-2025-001: CODESYS Key physical side-channel vulnerability - CSAFself
- Advisory2025-01_VDE-2025-001: CODESYS Key physical side-channel vulnerability - PDFself
- CODESYS Security Advisoriesexternal
remediations (2)
- MitigationFirmware <4.52 installed on CODESYS Key series 3
Regardless of the vulnerability described here, CODESYS GmbH recommends that physical access to the CODESYS Key should only be granted to authorized persons. Especially in the case of productive control systems, removal of the CODESYS Key can affect the controlled machine or process. This generally recommended restriction of access also reduces the attack surface for this vulnerability, as its exploitation requires physical access.
- FixedFirmware <4.52 installed on CODESYS Key series 3
Update the CODESYS Key firmware to version 4.52. Updating the firmware also protects the future usage of additional CODESYS Key features by the CODESYS software and general usage by other software. The update can be installed, for example, via the CodeMeter Control Center.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan