VDE-2021-033

TRUMPF Laser GmbH: multiple products prone to codesys runtime vulnerabilities

The TruControl laser control software (versions 1.04 to 3.0.0) uses CODESYS runtime versions affected by multiple CVEs: **CVE list:** - CVE-2021-29242 - CVE-2021-29241 - CVE-2019-5105 - CVE-2020-7052 - CVE-2019-9012 - CVE-2019-9010 - CVE-2019-9009 - CVE-2018-10612 In addition to the CVEs listed above, the affected products are also vulnerable to the following issues without a CVE ID: --- ### **CODESYS Advisory 2018-07** A crafted communication request may cause an access violation in the affected CODESYS products and may result in a denial-of-service condition. - **CVSS v3.0 base score:** 6.5 - **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H` 🔗 [Link to advisory](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12928&token=6d1dcea05a15aeef7ad48eadc64c8eca5d4f07b2&download=) --- ### **CODESYS Advisory 2018-04** The CODESYS runtime system allows access to files outside the restricted working directory of the controller by online services. - **CVSS v3.0 base score:** 9.9 - **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` 🔗 [Link to advisory](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12925&token=50e7240fa947ea215311e3db441f82152f1109b6&download=) --- ### **CODESYS Advisory 2017-03** A crafted request may cause an access violation in the affected CODESYS products and may result in a denial-of-service condition. - **CVSS v3.0 base score:** 7.5 - **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` 🔗 [Link to advisory](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12912&token=2f23e7f047c2768dd06fdf072de49a7ba1fe9687&download=)