CODESYS: Multiple products affected by WIBU Codemeter vulnerability
Several CODESYS setups contain and install vulnerable versions of the WIBU CodeMeter Runtime.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-3935US | — | — | ||
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- Mitigation
WIBU-SYSTEMS AG recommends updating to CodeMeter Runtime version 7.60c to fix the vulnerability. Until an update is available for the affected CODESYS products or if this is not to be installed, CODESYS GmbH recommends downloading and installing the current CodeMeter Runtime directly from the website of WIBU-SYSTEMS AG (https://www.wibu.com/support/user/user-software.html). If neither an update of the affected CODESYS products nor an update of the WIBU CodeMeter Runtime can be performed, you may find further mitigations in the Security Advisory WIBU-230704-01 provided by WIBUSYSTEMS AG (https://www.wibu.com/support/security-advisories.html).
- Behoben
Update the following products to version 3.5.19.30. • CODESYS Control RTE (SL) • CODESYS Control RTE (for Beckhoff CX) SL • CODESYS Control Win (SL) • CODESYS HMI (SL) • CODESYS Development System • CODESYS OPC DA Server SL Update the following products to version to 4.10.0.0. • CODESYS Control for Linux SL • CODESYS Control for Linux ARM SL For the legacy CODESYS V2 products, no new version is scheduled.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan