CODESYS Control V3 - OPC UA Server Authentication bypass
The OPC UA security policy Basic128Rsa15 is vulnerable against attacks on the private key. This can lead to loss of confidentiality or authentication bypass. The CODESYS OPC UA server is not affected in the default configuration. However, the affected policy may be enabled by a customer configuration.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-1468US | — | — | ||
An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-default Basic128Rsa15… | ||||
references
External citations — patches, advisories, analysis.
- Advisory2025-04_VDE-2025-022: CODESYS Control V3 - OPC UA Server Authentication bypass - HTMLself
- CERT@VDE Security Advisories for CODESYS GmbHexternal
- Advisory2025-04_VDE-2025-022: CODESYS Control V3 - OPC UA Server Authentication bypass - CSAFself
- Advisory2025-04_VDE-2025-022: CODESYS Control V3 - OPC UA Server Authentication bypass - PDFself
- CODESYS Security Advisoriesexternal
remediations (2)
- MitigationCODESYS Runtime Toolkit
If set, device manufactures need to remove the compiler #define "CMPOPCUASTACK_ALLOW_SHA1_BASED_SECURITY" from the build configuration of the CODESYS Runtime toolkit to restore the default value, which disables the affected OPC UA security policy Basic128Rsa15. Note: This prevents clients that only support the Basic128Rsa15 policy from connecting to the CODESYS UPC UA server.
- FixedCODESYS Runtime Toolkit
Update the following product to version 3.5.21.0 and follow the updated documentation: * CODESYS Runtime Toolkit This update has no direct functional impact, but the improved documentation strongly discourages the CODESYS Runtime Toolkit setting 'CMPOPCUASTACK_ALLOW_SHA1_BASED_SECURITY'. If set, device manufactures need to remove the compiler #define "CMPOPCUASTACK_ALLOW_SHA1_BASED_SECURITY" from the build configuration of the CODESYS Runtime toolkit to remediate the vulnerability. This restores the default configuration and disables the affected OPC UA security policy Basic128Rsa15. Note: This prevents clients that only support the Basic128Rsa15 policy from connecting to the CODESYS UPC UA server. Device manufacturers find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan