CVE-2023-37551
mediumPriorität · verfolgen · 26EPSS 0.005 · 42. PerzentilDEEURUUSEPSS · bewertet 2026-10-22
In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobencodesys_psirt
Update the following products to version 3.5.19.20. - CODESYS Control RTE (SL) - CODESYS Control RTE (for Beckhoff CX) SL - CODESYS Control Win (SL) - CODESYS Control Runtime System Toolkit - CODESYS Safety SIL2 Runtime Toolkit - CODESYS Safety SIL2 PSP - CODESYS HMI (SL) - CODESYS Development System V3 Update the following products to version to 4.10.0.0. This version is scheduled for October 2023. - CODESYS Control for BeagleBone SL - CODESYS Control for emPC-A/iMX6 SL - CODESYS Control for IOT2000 SL - CODESYS Control for Linux SL - CODESYS Control for PFC100 SL - CODESYS Control for PFC200 SL - CODESYS Control for PLCnext SL - CODESYS Control for Raspberry Pi SL - CODESYS Control for WAGO Touch Panels 600 SL The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area.
- Behobenwago_psirt
### Fixed Firmware 3 | Product | Status | |-------------|-----------| | 750-8000 | available | | 750-8001 | available | ### Fixed Firmware 26 #### Compact Controller 100 family | Product | Status | |---------------------|-----------| | 751-9301/xxx-xxx | available | | 751-9401/xxx-xxx | available | #### PFC 100 family | Product | Status | |---------------------|-----------| | 750-8100/xxx-xxx | available | | 750-8101/xxx-xxx | available | | 750-8102/xxx-xxx | available | #### PFC 200 family | Product | Status | |---------------------|-----------| | 750-8202/xxx-xxx | available | | 750-8203/xxx-xxx | available | | 750-8204/xxx-xxx | available | | 750-8206/xxx-xxx | available | | 750-8207/xxx-xxx | available | | 750-8210/xxx-xxx | available | | 750-8211/xxx-xxx | available | | 750-8212/xxx-xxx | available | | 750-8213/xxx-xxx | available | | 750-8214/xxx-xxx | available | | 750-8215/xxx-xxx | available | | 750-8216/xxx-xxx | available | | 750-8217/xxx-xxx | available | #### TP 600 family | Product | Status | |------------------------|-----------| | 762-4x0x/8000-000x | available | | 762-5x0x/8000-000x | available | | 762-6x0x/8000-000x | available | #### EC 300 family | Product | Status | |------------------------|-----------| | 752-8303/8000-0002 | available | ### Fixed Firmware 22 Patch 2 #### Compact Controller 100 family | Product | Status | |---------------------|-----------| | 751-9301/xxx-xxx | planned | | 751-9401/xxx-xxx | planned | #### PFC 100 family | Product | Status | |---------------------|-----------| | 750-8100/xxx-xxx | planned | | 750-8101/xxx-xxx | planned | | 750-8102/xxx-xxx | planned | #### PFC 200 family | Product | Status | |---------------------|-----------| | 750-8202/xxx-xxx | planned | | 750-8203/xxx-xxx | planned | | 750-8204/xxx-xxx | planned | | 750-8206/xxx-xxx | planned | | 750-8207/xxx-xxx | planned | | 750-8210/xxx-xxx | planned | | 750-8211/xxx-xxx | planned | | 750-8212/xxx-xxx | planned | | 750-8213/xxx-xxx | planned | | 750-8214/xxx-xxx | planned | | 750-8215/xxx-xxx | planned | | 750-8216/xxx-xxx | planned | | 750-8217/xxx-xxx | planned | #### TP 600 family | Product | Status | |------------------------|-----------| | 762-4x0x/8000-000x | planned | | 762-5x0x/8000-000x | planned | | 762-6x0x/8000-000x | planned | #### EC 300 family | Product | Status | |------------------------|-----------| | 752-8303/8000-0002 | planned | A fixed version of e!COCKPIT is planned.
- BehobenEasy Harmony HMIET6/HMIFT6 Magelis HMIGXU seriescisa_csaf_ot
Vijeo Designer Basic v2.0 HotFix 2 includes a fix for this vulnerability. Please contact your Schneider Electric Customer Care Center to obtain the installer. To complete the update, connect to Harmony HMI and download the firmware using Vijeo Designer Basic.
https://www.se.com/us/en/work/support/contacts.jsp - BehobenEasy Modicon M310cisa_csaf_ot
Version 3.1.5.82 includes a fix for this vulnerability and can be download here: https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 As an alternative, contact your Schneider Electric Customer Care Center to obtain the firmware. To complete the update, connect to M310 and download the firmware using EcoStruxureTM Motion Expert.
https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 - BehobenHMISCU Controllercisa_csaf_ot
Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.
https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware - BehobenHarmony (Formerly Magelis) HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU seriescisa_csaf_ot
Version 6.3 HF3 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. As an alternative, please contact your Schneider Electric Customer Care Center to obtain the Hot Fix. For additional detail please refer to the supplied help file in Hot Fix. On the engineering workstation, update to v6.3 HF3 of Vijeo Designer.
- BehobenModicon Controller M241cisa_csaf_ot
Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ - BehobenModicon Controller M251cisa_csaf_ot
Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ - BehobenModicon Controller M262cisa_csaf_ot
Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ - BehobenPacDrive 3 Controllers: LMC Eco/Pro/Pro2 cisa_csaf_ot
PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ - BehobenSchneider Electric Vijeo Designer runtime Versions Prior to 6.3 SP2 installed on Schneider Electric Harmony P6 seriescisa_csaf_ot
Version 6.3 SP2 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware As an alternative, please contact your Schneider Electric Customer Care Center to obtain the Fix. For additional details, please refer to the supplied help file in Hot Fix. On the engineering workstation, update to v6.3 SP2 of Vijeo Designer.
https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware - BehobenSchneider Electric Vijeo Designer runtime Versions Prior to 6.3 SP2 installed on Schneider Electric Harmony iPC seriescisa_csaf_ot
Version 6.3 SP2 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware As an alternative, please contact your Schneider Electric Customer Care Center to obtain the Fix. For additional details, please refer to the supplied help file in Hot Fix. On the engineering workstation, update to v6.3 SP2 of Vijeo Designer.
https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware - BehobenSoftSPS embedded in EcoStruxure Machine Expertcisa_csaf_ot
SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application.
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ - BehobenVijeo Designer embedded in EcoStruxure Machine Expert cisa_csaf_ot
Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.
https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware - MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0festo_psirt
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
- MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10festo_psirt
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
- Mitigationcodesys_psirt
To exploit these vulnerabilities, a successful login to the affected product is required. The online user management therefore protects from exploiting these security vulnerabilities. CODESYS GmbH strongly recommends using the online user management. This not only prevents an attacker from sending malicious requests or downloading virulent code, but also suppresses starting, stopping, debugging or other actions on a known working application that could potentially disrupt a machine or system. As of version 3.5.17.0, the online user management is enforced by default.
- Mitigationwago_psirt
Depending on the vulnerability there are possible mitigations: Vulnerability of CODESYS Advisory 2023-05: - This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: - Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. - Use firewalls to protect and separate the control system network from other networks. - Use VPN (Virtual Private Networks) tunnels if remote access is required. - Activate and apply user management and password features. - Use encrypted communication links. - Limit the access to both development and control system by physical means, operating system features, etc. - Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html
- MitigationEasy Modicon M310cisa_csaf_ot
Customers should immediately apply the following mitigations to reduce the risk of exploitation: • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.• Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.• Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.• Use firewalls to protect and separate the control system network from other networks.• Use VPN (Virtual Private Networks) tunnels if remote access is required. • Limit the access to both development and control system by physical means, operating system features, etc. • Protect both development and control system by using up to date malware protection.
- MitigationHMISCU Controllercisa_csaf_ot
• Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.
- MitigationModicon Controller LMC058cisa_csaf_ot
• Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.
- MitigationModicon Controller M241cisa_csaf_ot
• Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.
- MitigationModicon Controller M251cisa_csaf_ot
• Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.
- MitigationModicon Controller M258cisa_csaf_ot
• Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.
- MitigationModicon Controller M262cisa_csaf_ot
• Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.
- MitigationPacDrive 3 Controllers: LMC Eco/Pro/Pro2 cisa_csaf_ot
• Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.
- MitigationSoftSPS embedded in EcoStruxure Machine Expertcisa_csaf_ot
• Enable the optional ‘Implicit Checks’ on logic applications. • Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. • Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. • Use firewalls to protect and separate the control system network from other networks. • Use VPN (Virtual Private Networks) tunnels if remote access is required. • Limit the access to both development and control system by physical means, operating system features, etc. • Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp
- MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0cisa_csaf_ot
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
- MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10cisa_csaf_ot
Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
- Kein Fix geplantMagelis XBT seriescisa_csaf_ot
Schneider Electric’s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven't been replaced, please contact your local Schneider Electric technical support for more information.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (124)
Betroffene Produkte und Versionsbereiche.
- CODESYS Development System 3.5.21.20 external component of Festo Automation Suite 2.8.0.138alle Versionenfixedcisa_csaf_otUScpe:2.3:a:codesys:development_system:3.5.21.20*:*:*:*:*:*:*:*
- Festo Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0alle Versionencisa_csaf_otUScpe:2.3:a:codesys:development_system:3.0:*:*:*:*:*:*:*
- Festo Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10alle Versionencisa_csaf_otUScpe:2.3:a:codesys:development_system:3.5.16.10:*:*:*:*:*:*:*
Advisories (7)
Hersteller- und Ökosystem-Meldungen dazu.
- FSA-202601Several CODESYS vulnerabilities in Festo Automation Suite2026-02-26csaf · festo_psirtDE
Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.
- VDE-2023-019CODESYS: Multiple Vulnerabilities in CmpApp CmpAppBP and CmpAppForce2023-08-03csaf · codesys_psirtDE
CODESYS Control V3 runtime systems are affected by several security vulnerabilities in the communication server implementations for the CODESYS protocol. These may be exploited by authenticated attackers.
- VDE-2023-068WAGO: Multiple Vulnerabilities in e!Cockpit and e!Runtime / CODESYS Runtime2024-05-21csaf · wago_psirtDE
The following vulnerabilities are published with reference to CODESYS Advisory 2023-05, CODESYS Advisory 2023-06 and CODESYS Advisory 2023-09
- WID-SEC-W-2024-0134ABB AC-500: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2024-01-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ABB AC-500 ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2024-0943CODESYS: Mehrere SchwachstellenDeutsch2024-04-21csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in CODESYS ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder einen Brute-Force-Angriff durchzuführen.
- ICSA-26-020-02Schneider Electric devices using CODESYS Runtime2023-07-11icsa · cisa_csaf_otUS
Schneider Electric is aware of multiple vulnerabilities disclosed on CODESYS runtime system V3 communication server. Many vendors, including Schneider Electric, embed CODESYS in their offers. If successfully exploited, these vulnerabilities could result in a denial of service or, in some cases, in remote code execution on PacDrive controllers, Modicon Controllers M241 / M251 / M262 / M258 / LMC058 / LMC078 / M218 , HMISCU, the Simulation Runtime SoftSPS from EcoStruxure Machine Expert and EcoStruxure Microgrid Operation products. Failure to apply the mitigations provided below may result in denial of service and/or arbitrary remote code execution.
- ICSA-26-076-01CODESYS in Festo Automation Suite2026-02-26icsa · cisa_csaf_otUS
Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (5)
Externe Belege — Patches, Meldungen, Analysen.
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan