CODESYS Key physical side-channel vulnerability
The CODESYS Key USB dongle, which is based on WIBU CodeMeter technology, is affected by a physical side-channel vulnerability.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-45678US | medium4.2 | — | ||
Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical acce… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Advisory2025-01_VDE-2025-001: CODESYS Key physical side-channel vulnerability - HTMLself
- CERT@VDE Security Advisories for CODESYS GmbHexternal
- Advisory2025-01_VDE-2025-001: CODESYS Key physical side-channel vulnerability - CSAFself
- Advisory2025-01_VDE-2025-001: CODESYS Key physical side-channel vulnerability - PDFself
- CODESYS Security Advisoriesexternal
Behebungen (2)
- MitigationFirmware <4.52 installed on CODESYS Key series 3
Regardless of the vulnerability described here, CODESYS GmbH recommends that physical access to the CODESYS Key should only be granted to authorized persons. Especially in the case of productive control systems, removal of the CODESYS Key can affect the controlled machine or process. This generally recommended restriction of access also reduces the attack surface for this vulnerability, as its exploitation requires physical access.
- BehobenFirmware <4.52 installed on CODESYS Key series 3
Update the CODESYS Key firmware to version 4.52. Updating the firmware also protects the future usage of additional CODESYS Key features by the CODESYS software and general usage by other software. The update can be installed, for example, via the CodeMeter Control Center.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan