CODESYS: CODESYS web server vulnerable to DoS
The CODESYS web server component of the CODESYS Control runtime system is used by the CODESYS WebVisu to display visualization screens in a web browser. Receiving a specifically crafted TLS packet on an HTTPS connection causes the CODESYS web server to crash because the return value of an underlying function is not checked correctly for such unusual conditions.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-8175US | — | — | ||
An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- Behoben
Update the following products to version 3.5.20.30. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS HMI (SL) * CODESYS Runtime Toolkit * CODESYS Embedded Target Visu Toolkit * CODESYS Remote Target Visu Toolkit The products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS download area.
- BehobenControl for IOT2000 SL
Update the following product to version 4.15.0.0 (Version 4.14.0.0 has not been released). * CODESYS Control for IOT2000 SL The products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS download area.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan