CODESYS: Development System V2.3 affected by two vulnerabilities through corrupted project files
Local attackers can cause affected CODESYS Development System V2.3 installations to crash or execute code by opening malicious project files. The CODESYS Development System V2.3 is an IEC 61131-3 programming tool for the industrial controller and automation technology sector. It stores the program code for the controller and its configuration in project files (*.pro).
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-49676US | — | — | ||
An unauthenticated local attacker may trick a user to open corrupted project files to crash the system due to use after free vulnerability. | ||||
| CVE-2023-49675US | — | — | ||
An unauthenticated local attacker may trick a user to open corrupted project files to execute arbitrary code or crash the system due to an out-of-bounds write vulnerability.
| ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (4)
- MitigationFirmware <2.3.9.73 installed on CODESYS Development System V2.3
CODESYS GmbH strongly recommends only opening projects from trustworthy sources! If the following dialog appears when opening a project, please pay attention to this warning and do not try to load the affected project: "The project file is corrupt. Would you still like to try to load the project? Attention! CODESYS could become unstable when loading a corrupt project file." In addition, we recommend saving projects with password encryption, which offers even more protection against tampering of the project.
- MitigationFirmware <2.3.9.73 installed on CODESYS Development System V2.3
CODESYS GmbH strongly recommends only opening projects from trustworthy sources! If the following dialog appears when opening a project, please pay attention to this warning and do not try to load the affected project: "The project file is corrupt. Would you still like to try to load the project? Attention! CODESYS could become unstable when loading a corrupt project file." In addition, we recommend saving projects with password encryption, which offers even more protection against tampering of the project.
- BehobenFirmware <2.3.9.73 installed on CODESYS Development System V2.3
Update the CODESYS Development System V2.3 to version 2.3.9.73. As of this version, projects recognized as corrupt can no longer be opened with the CODESYS Development System V2.3. If the CODESYS Development System V2.3 detects that the project file has been manipulated, the user will be informed, and the loading will be terminated. Note: CODESYS V2.3 is currently in the service phase. Please consider upgrading to CODESYS V3. Please visit the CODESYS download area for more information on how to obtain the software update.
- BehobenFirmware <2.3.9.73 installed on CODESYS Development System V2.3
Update the CODESYS Development System V2.3 to version 2.3.9.73. As of this version, projects recognized as corrupt can no longer be opened with the CODESYS Development System V2.3. If the CODESYS Development System V2.3 detects that the project file has been manipulated, the user will be informed, and the loading will be terminated. Note: CODESYS V2.3 is currently in the service phase. Please consider upgrading to CODESYS V3. Please visit the CODESYS download area for more information on how to obtain the software update.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan