CVE-2023-3662

highPriorität · verfolgen · 0EPSS 0.002 · 11. PerzentilDEEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.21% (11th) EPSS
CVSS 7.3 · high
Is it mine?
48 products
Prüfe deine Angriffsfläche
Who says so?
7 sources
cnnvd · enisa_euvd · cert_bund · cisa_csaf_ot

EPSS · bewertet 2026-10-22

In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context .

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenCODESYS Development Systemcodesys_psirt

    Update the CODESYS Development System to version 3.5.19.20. The CODESYS Development System can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, you will find further information on obtaining the software update in the CODESYS Update area

  • Behobenwago_psirt

    ### Fixed Firmware 3 | Product | Status | |-------------|-----------| | 750-8000 | available | | 750-8001 | available | ### Fixed Firmware 26 #### Compact Controller 100 family | Product | Status | |---------------------|-----------| | 751-9301/xxx-xxx | available | | 751-9401/xxx-xxx | available | #### PFC 100 family | Product | Status | |---------------------|-----------| | 750-8100/xxx-xxx | available | | 750-8101/xxx-xxx | available | | 750-8102/xxx-xxx | available | #### PFC 200 family | Product | Status | |---------------------|-----------| | 750-8202/xxx-xxx | available | | 750-8203/xxx-xxx | available | | 750-8204/xxx-xxx | available | | 750-8206/xxx-xxx | available | | 750-8207/xxx-xxx | available | | 750-8210/xxx-xxx | available | | 750-8211/xxx-xxx | available | | 750-8212/xxx-xxx | available | | 750-8213/xxx-xxx | available | | 750-8214/xxx-xxx | available | | 750-8215/xxx-xxx | available | | 750-8216/xxx-xxx | available | | 750-8217/xxx-xxx | available | #### TP 600 family | Product | Status | |------------------------|-----------| | 762-4x0x/8000-000x | available | | 762-5x0x/8000-000x | available | | 762-6x0x/8000-000x | available | #### EC 300 family | Product | Status | |------------------------|-----------| | 752-8303/8000-0002 | available | ### Fixed Firmware 22 Patch 2 #### Compact Controller 100 family | Product | Status | |---------------------|-----------| | 751-9301/xxx-xxx | planned | | 751-9401/xxx-xxx | planned | #### PFC 100 family | Product | Status | |---------------------|-----------| | 750-8100/xxx-xxx | planned | | 750-8101/xxx-xxx | planned | | 750-8102/xxx-xxx | planned | #### PFC 200 family | Product | Status | |---------------------|-----------| | 750-8202/xxx-xxx | planned | | 750-8203/xxx-xxx | planned | | 750-8204/xxx-xxx | planned | | 750-8206/xxx-xxx | planned | | 750-8207/xxx-xxx | planned | | 750-8210/xxx-xxx | planned | | 750-8211/xxx-xxx | planned | | 750-8212/xxx-xxx | planned | | 750-8213/xxx-xxx | planned | | 750-8214/xxx-xxx | planned | | 750-8215/xxx-xxx | planned | | 750-8216/xxx-xxx | planned | | 750-8217/xxx-xxx | planned | #### TP 600 family | Product | Status | |------------------------|-----------| | 762-4x0x/8000-000x | planned | | 762-5x0x/8000-000x | planned | | 762-6x0x/8000-000x | planned | #### EC 300 family | Product | Status | |------------------------|-----------| | 752-8303/8000-0002 | planned | A fixed version of e!COCKPIT is planned.

  • BehobenCODESYS Development Systemcisa_csaf_ot

    CODESYS recommends users update the CODESYS Development System to version 3.5.19.20.

  • BehobenEasy Harmony HMIET6/HMIFT6 Magelis HMIGXU seriescisa_csaf_ot

    Vijeo Designer Basic v2.0 HotFix 2 includes a fix for this vulnerability. Please contact your Schneider Electric Customer Care Center to obtain the installer. To complete the update, connect to Harmony HMI and download the firmware using Vijeo Designer Basic.

    https://www.se.com/us/en/work/support/contacts.jsp
  • BehobenEasy Modicon M310cisa_csaf_ot

    Version 3.1.5.82 includes a fix for this vulnerability and can be download here: https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 As an alternative, contact your Schneider Electric Customer Care Center to obtain the firmware. To complete the update, connect to M310 and download the firmware using EcoStruxureTM Motion Expert.

    https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310
  • BehobenHMISCU Controllercisa_csaf_ot

    Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.

    https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware
  • BehobenHarmony (Formerly Magelis) HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU seriescisa_csaf_ot

    Version 6.3 HF3 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. As an alternative, please contact your Schneider Electric Customer Care Center to obtain the Hot Fix. For additional detail please refer to the supplied help file in Hot Fix. On the engineering workstation, update to v6.3 HF3 of Vijeo Designer.

  • BehobenModicon Controller M241cisa_csaf_ot

    Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.

    https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/
  • BehobenModicon Controller M251cisa_csaf_ot

    Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.

    https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/
  • BehobenModicon Controller M262cisa_csaf_ot

    Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.

    https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/
  • BehobenPacDrive 3 Controllers: LMC Eco/Pro/Pro2 cisa_csaf_ot

    PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.

    https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/
  • BehobenSchneider Electric Vijeo Designer runtime Versions Prior to 6.3 SP2 installed on Schneider Electric Harmony P6 seriescisa_csaf_ot

    Version 6.3 SP2 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware As an alternative, please contact your Schneider Electric Customer Care Center to obtain the Fix. For additional details, please refer to the supplied help file in Hot Fix. On the engineering workstation, update to v6.3 SP2 of Vijeo Designer.

    https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware
  • BehobenSchneider Electric Vijeo Designer runtime Versions Prior to 6.3 SP2 installed on Schneider Electric Harmony iPC seriescisa_csaf_ot

    Version 6.3 SP2 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware As an alternative, please contact your Schneider Electric Customer Care Center to obtain the Fix. For additional details, please refer to the supplied help file in Hot Fix. On the engineering workstation, update to v6.3 SP2 of Vijeo Designer.

    https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware
  • BehobenSoftSPS embedded in EcoStruxure Machine Expertcisa_csaf_ot

    SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application.

    https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/
  • BehobenVijeo Designer embedded in EcoStruxure Machine Expert cisa_csaf_ot

    Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.

    https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware
  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0festo_psirt

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10festo_psirt

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • Mitigationwago_psirt

    Depending on the vulnerability there are possible mitigations: Vulnerability of CODESYS Advisory 2023-05: - This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: - Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. - Use firewalls to protect and separate the control system network from other networks. - Use VPN (Virtual Private Networks) tunnels if remote access is required. - Activate and apply user management and password features. - Use encrypted communication links. - Limit the access to both development and control system by physical means, operating system features, etc. - Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html

  • MitigationCODESYS Development Systemcisa_csaf_ot

    For more information, please see the advisory CERT@VDE published for CODESYS at: (https://cert.vde.com/en-us/advisories/vde-2023-021)[https://cert.vde.com/en-us/advisories/vde-2023-021]

    https://cert.vde.com/en-us/advisories/vde-2023-021)%5Bhttps://cert.vde.com/en-us/advisories/vde-2023-021%5D
  • MitigationEasy Modicon M310cisa_csaf_ot

    Customers should immediately apply the following mitigations to reduce the risk of exploitation: • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.• Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.• Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.• Use firewalls to protect and separate the control system network from other networks.• Use VPN (Virtual Private Networks) tunnels if remote access is required. • Limit the access to both development and control system by physical means, operating system features, etc. • Protect both development and control system by using up to date malware protection.

  • MitigationHMISCU Controllercisa_csaf_ot

    • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.

  • MitigationModicon Controller LMC058cisa_csaf_ot

    • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.

  • MitigationModicon Controller M241cisa_csaf_ot

    • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.

  • MitigationModicon Controller M251cisa_csaf_ot

    • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.

  • MitigationModicon Controller M258cisa_csaf_ot

    • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.

  • MitigationModicon Controller M262cisa_csaf_ot

    • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.

  • MitigationPacDrive 3 Controllers: LMC Eco/Pro/Pro2 cisa_csaf_ot

    • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.

  • MitigationSoftSPS embedded in EcoStruxure Machine Expertcisa_csaf_ot

    • Enable the optional ‘Implicit Checks’ on logic applications. • Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. • Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. • Use firewalls to protect and separate the control system network from other networks. • Use VPN (Virtual Private Networks) tunnels if remote access is required. • Limit the access to both development and control system by physical means, operating system features, etc. • Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0cisa_csaf_ot

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10cisa_csaf_ot

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • Kein Fix geplantMagelis XBT seriescisa_csaf_ot

    Schneider Electric’s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven't been replaced, please contact your local Schneider Electric technical support for more information.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.3
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.7–7.3

v3.07.3highCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.17.3highCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.17.3highCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · info@cert.vde.comAusnutzbarkeit 1.3 · Auswirkung 5.9
v3.17.3highCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · WAGO PSIRT DE
v3.17.3highCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · Festo PSIRT DE
v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.17.3highCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.17.3highCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · CODESYS PSIRT
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-427USCWE-427USCWE-427USCWE-427USCWE-427US
05

betroffene Produkte (48)

Betroffene Produkte und Versionsbereiche.

20 von 48 angezeigt
06

Advisories (7)

Hersteller- und Ökosystem-Meldungen dazu.

  • FSA-202601Several CODESYS vulnerabilities in Festo Automation Suite2026-02-26csaf · festo_psirtDE

    Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

  • VDE-2023-021CODESYS: Vulnerability in CODESYS Development System allows execution of binaries2023-08-03csaf · codesys_psirtDE

    The CODESYS Development System is vulnerable to the execution of malicious binaries from the current working directory.

  • VDE-2023-068WAGO: Multiple Vulnerabilities in e!Cockpit and e!Runtime / CODESYS Runtime2024-05-21csaf · wago_psirtDE

    The following vulnerabilities are published with reference to CODESYS Advisory 2023-05, CODESYS Advisory 2023-06 and CODESYS Advisory 2023-09

  • WID-SEC-W-2024-0943CODESYS: Mehrere SchwachstellenDeutsch2024-04-21csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in CODESYS ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder einen Brute-Force-Angriff durchzuführen.

  • ICSA-23-236-03CODESYS Development System2023-08-24icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could cause users to unknowingly launch a malicious binary placed by a local attacker.

  • ICSA-26-020-02Schneider Electric devices using CODESYS Runtime2023-07-11icsa · cisa_csaf_otUS

    Schneider Electric is aware of multiple vulnerabilities disclosed on CODESYS runtime system V3 communication server. Many vendors, including Schneider Electric, embed CODESYS in their offers. If successfully exploited, these vulnerabilities could result in a denial of service or, in some cases, in remote code execution on PacDrive controllers, Modicon Controllers M241 / M251 / M262 / M258 / LMC058 / LMC078 / M218 , HMISCU, the Simulation Runtime SoftSPS from EcoStruxure Machine Expert and EcoStruxure Microgrid Operation products. Failure to apply the mitigations provided below may result in denial of service and/or arbitrary remote code execution.

  • ICSA-26-076-01CODESYS in Festo Automation Suite2026-02-26icsa · cisa_csaf_otUS

    Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

07

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdcert_bundcisa_csaf_otfesto_psirtcodesys_psirtwago_psirtNVDCVE.orgMITRE
veröffentlicht 2023-08-03geändert 2026-06-17
09

Referenzen (6)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan