CVE-2024-6876

mediumPriorität · verfolgen · 18EPSS 0.002 · 9. PerzentilDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.19% (9th) EPSS
CVSS 4.4 · medium
Is it mine?
18 products
Prüfe deine Angriffsfläche
Who says so?
6 sources
cnnvd · enisa_euvd · cert_bund · cisa_csaf_ot

EPSS · bewertet 2026-10-28

Out-of-Bounds read vulnerability in OSCAT Basic Library allows an local, unprivileged attacker to access limited internal data of the PLC which may lead to a crash of the affected service.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobencodesys_psirt

    Update the OSCAT Basic library to version 3.3.5. The OSCAT Basic library version 3.3.5 is expected to be released in September 2024. To make the fix effective for existing CODESYS projects, you also must adjust the version of the OSCAT Basic library to be used in the Library Manager of the CODESYS project to version 3.3.5.0. Then you must update the CODESYS application on the PLC by download or online change and rebuild/download the boot application.

  • Mitigationcodesys_psirt

    CODESYS GmbH recommends an update of the OSCAT Basic library to address the security vulnerability. Without an update, the vulnerability can be prevented by validating all values in the PLC program before they are passed to the affected function. In particular, negative values must be blocked as function parameters of MONTH_TO_STRING. Regardless of whether the OSCAT Basic library in the programming system was updated or the security vulnerability in the PLC program was mitigated, a download or online change must be performed to update the application on the PLC. And don't forget to rebuild/download the boot project.

  • MitigationCODESYS OSCAT Basic Librarycisa_csaf_ot

    CODESYS GmbH recommends users update OSCAT Basic Library to address the security vulnerability:

  • Mitigationoscat.de OSCAT Basic Librarycisa_csaf_ot

    CODESYS GmbH recommends users update OSCAT Basic Library to address the security vulnerability:

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

5.1
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.14.4mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Lprimary · NVD / NIST USAusnutzbarkeit 1.8 · Auswirkung 2.5
v3.15.1mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Lsecondary · CISA US
v3.14.4mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Lsecondary · ENISA EU
v3.14.4mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Lsecondary · info@cert.vde.comAusnutzbarkeit 1.8 · Auswirkung 2.5
v3.14.1mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:Usecondary · CVSS-BT (t0sche)
v3.15.1mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Lsecondary · CODESYS PSIRT
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-125USCWE-125USCWE-125US
05

betroffene Produkte (18)

Betroffene Produkte und Versionsbereiche.

06

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

  • VDE-2024-046OSCAT: Out-of-bounds read in OSCAT Basic library2024-09-10csaf · codesys_psirtDE

    The OSCAT Basic library is one of several libraries developed and provided by OSCAT. OSCAT (oscat.de) stands for "Open Source Community for Automation Technology". The OSCAT Basic library offers function blocks for various tasks, e.g. for buffer management, list processing, control technology, mathematics, string processing, time and date conversion. By adding the OSCAT Basic library into IEC 61131-3-compliant programming tools, PLC programmers can use all the functions provided by the library in their control programs. Within the library, the MONTH_TO_STRING function is affected by an out-of-bounds read vulnerability. Exploitation of the vulnerability may lead to limited access to internal data or possibly to a crash of the PLC.

  • WID-SEC-W-2024-2096CODESYS: Schwachstelle in der OSCAT Basic Bibliothek ermöglicht Denial of ServiceDeutsch2024-09-09csaf · cert_bundDE

    Ein lokaler Angreifer kann eine Schwachstelle in CODESYS in der OSCAT Basic Bibliothek ausnutzen, um einen Denial of Service Angriff durchzuführen.

  • ICSA-24-326-02OSCAT Basic Library2024-11-21icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability allows an local, unprivileged attacker to access limited internal data of the PLC, which may lead to a crash of the affected service.

07

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdcert_bundcisa_csaf_otcodesys_psirtnvdNVDCVE.orgMITRE
veröffentlicht 2024-09-10geändert 2026-06-17
09

Referenzen (8)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan