Advisory2025-03_VDE-2025-015

Regardless of the vulnerability described here, CODESYS GmbH recommends that physical access to the controller should only be granted to authorized persons. Especially in the case of productive control systems, physical manipulation of the controller can affect the controlled machine or process. This generally recommended restriction of access also reduces the attack surface for this vulnerability, as its exploitation requires physical access. To exploit this vulnerability, a successful login to the affected product is required. The online user management therefore protects from exploiting this security vulnerability. CODESYS GmbH strongly recommends using the online user management, which is enforced by default. This not only prevents from accessing the file system with malicious symbolic links, but also suppresses modifying the PLC application, or starting, stopping, debugging or other actions on a known working PLC application that could potentially disrupt a machine or system. To fully mitigate this vulnerability, system administrators can restrict the use of removable media to devices that do not support symbolic links, such as FAT16 or FAT32. Since these file systems lack symbolic link functionality, this effectively prevents any symbolic link-based attacks. Alternatively, remove PlaceHolderFilePath settings from the CODESYS Control configuration file, which point to removable media such as: [SysFile] PlaceholderFilePath.1=/media/usb, $USB$

Update the following products to version 3.5.21.0. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS Runtime Toolkit If removable media is configured for the CODESYS Control runtime, make sure that any additional removable storage beyond the boot partition is set as volatile in the CODESYS Control configuration file with the entry "PlaceholderFilePath.<n>.Volatile=1". Then the fixed CODESYS Control runtime systems ensure that only configured/permitted paths can be accessed, even with a symbolic link on a removable media. Example: [SysFile] PlaceholderFilePath.1=/media/usb, $USB$ PlaceholderFilePath.1.View=1 PlaceholderFilePath.1.Volatile=1 The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download.