Advisory2025-02_VDE-2025-013

There are two possibilities to mitigate the vulnerability in CODESYS (Edge) Gateways with versions before 3.5.21.0: 1. Check the "LocalAddress" setting in the [CmpGwCommDrvTcp] section of the Gateway's configuration file as follows: [CmpGwCommDrvTcp] LocalAddress=127.0.0.1 ; allow access only from the local computer ;LocalAddress=192.168.1.1 ; IP address (of any adapter) to be listened to - access is only allowed via this address ;LocalAddress=0.0.0.0 ; allow access from any remote machine 2. To reset the Microsoft Windows firewall rule, you must first uninstall the setup that was originally used to install the affected CODESYS Gateway. Beside the standalone Gateway setup, this can be one of the following setups: • CODESYS Development System V3 • CODESYS Control Win (SL) • CODESYS HMI • CODESYS OPC DA Server SL Afterward, perform the custom steps in the setup and ensure that the "CODESYS Gateway" is unchecked in the "Firewall Settings" screen.

Update the following products to version 3.5.21.0. • CODESYS Edge Gateway for Windows • CODESYS Gateway for Windows Please note that a new version of the CODESYS (Edge) Gateway for Windows can be installed either with the corresponding standalone setup or as part of the setups of the following other CODESYS products: • CODESYS Development System V3 • CODESYS Control Win (SL) • CODESYS HMI • CODESYS OPC DA Server SL To ensure that all firewall rules are reset, we recommend uninstalling the previously mentioned setups that installed an affected Gateway. Compatibility notes: By default, all 3.5.21.0 setups that install a CODESYS (Edge) Gateway configure the CODESYS Gateway to only allow local client access and do not add a Microsoft Windows firewall rule for CODESYS Gateways V3 and V2.3. However, if remote access is required, you can follow the custom steps in the setup and select the 'Allow remote access' checkbox. In addition, remote access can be enabled for specific IP addresses by changing the 'LocalAddress' setting in the [CmpGwCommDrvTcp] section in the Gateway.cfg file: [CmpGwCommDrvTcp] LocalAddress=127.0.0.1 ; allow access only from the local computer ;LocalAddress=192.168.1.1 ; IP address (of any adapter) to be listened to - access is only allowed via this address ;LocalAddress=0.0.0.0 ; allow access from any remote machine The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download.