CODESYS Gateway Client - Uncontrolled Memory Allocation
The CODESYS Gateway Client (CmpGatewayClient) is used by various CODESYS products to establish PLC communication via the CODESYS Gateway. Due to missing limits on memory allocations derived from a size field in a gateway response, a malicious gateway can cause excessive memory consumption in the client, resulting in a denial-of-service condition. The vulnerability can be exploited when an affected product connects to an attacker-controlled gateway.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-76992US | high7.5 | — | ||
The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Advisory2026-11_VDE-2026-094: CODESYS Gateway Client - Uncontrolled Memory Allocation - PDFself
- Advisory2026-11_VDE-2026-094: CODESYS Gateway Client - Uncontrolled Memory Allocation - CSAFself
- Advisory2026-11_VDE-2026-094: CODESYS Gateway Client - Uncontrolled Memory Allocation - HTMLself
- CERT@VDE Security Advisories for CODESYS GmbHexternal
- CODESYS Security Advisoriesexternal
Behebungen (2)
- Kein Fix verfügbarCODESYS Edge Gateway for Linux
Update the following product to version 4.23.0.0. The release of this version is expected in Q4 2026. * CODESYS Edge Gateway for Linux The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
- Behoben
Update the following products to version 3.5.22.40. * CODESYS Development System 3 * CODESYS Gateway * CODESYS Edge Gateway for Windows * CODESYS HMI (SL) * CODESYS OPC DA Server SL * CODESYS PLCHandler * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan