VDE-2021-014

WAGO: Multiple Vulnerabilities in CODESYS Runtime 2.3

Advisory ansehen veröffentlicht 2021-05-20

Multiple vulnerabilities were reported in CODESYS 2.3 Runtime. The CODESYS 2.3 Runtime is an essential component in several WAGO PLC's.

beschreibt (12)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2021-30195US	high7.5	7.55% (94th)	—	2021-05-25
CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.
CVE-2021-30194US	critical9.1	1.12% (66th)	—	2021-05-25
CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read.
CVE-2021-30193US	critical9.8	1.12% (66th)	—	2021-05-25
CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write.
CVE-2021-30192US	critical9.8OT erhöht	1.12% (66th)	—	2021-05-25
CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check.
CVE-2021-30191US	high7.5	0.99% (62nd)	—	2021-05-25
CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input.
CVE-2021-30190US	critical9.8OT erhöht	1.39% (72nd)	—	2021-05-25
CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.
CVE-2021-30189US	critical9.8	1.24% (69th)	—	2021-05-25
CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow.
CVE-2021-30188US	critical9.8	1.27% (70th)	—	2021-05-25
CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.
CVE-2021-30186US	high7.5	7.74% (95th)	—	2021-05-25
CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.
CVE-2021-30187US	medium5.3	0.27% (19th)	—	2021-05-25
CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.
CVE-2021-21001US	medium6.5	1.13% (66th)	—	2021-05-24
On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher p…
CVE-2021-21000US	high7.5	1.04% (64th)	—	2021-05-24
On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of service for the login servi…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

Behebungen (24)

Mitigation
If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.
Mitigation
If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.
Mitigation
If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.
Mitigation
If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.
Mitigation
If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.
Mitigation
If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.
Mitigation
If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.
Mitigation
If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.
Mitigation
If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.
Mitigation
If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.
Mitigation
If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.
Mitigation
If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.
Behoben
Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.
Behoben
Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.
Behoben
Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.
Behoben
Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.
Behoben
Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.
Behoben
Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.
Behoben
Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.
Behoben
Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.
Behoben
Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.
Behoben
Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.
Behoben
Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.
Behoben
Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan