Summary
The Festo controller CECC product family is affected by multiple vulnerabilities in the CODESYS V3 runtime.
Details
Impact
By using the listed vulnerabilities an remote attacker with low privileges may gain full access to the devices or make them unavailable.
Remediation
For CVE-2010-5250, CVE-2017-3735, CVE-2018-0739, CVE-2018-10612, CVE-2018-20025, CVE-2018-20026, CVE-2019-13532, CVE-2019-13542, CVE-2019-13548, CVE-2019-18858, CVE-2019-9008, CVE-2019-9009, CVE-2019-9010, CVE-2019-9012, CVE-2020-7052: Update to version 2.4.2.0. This also fixes CODESYS Advisory 2017-01, CODESYS Advisory 2017-03, CODESYS Advisory 2017-06, CODESYS Advisory 2017-07, CODESYS Advisory 2017-09, CODESYS Advisory 2018-04, CODESYS Advisory 2018-05, CODESYS Advisory 2018-07, CODESYS Advisory 2018-11.
For CVE-2019-5105, CVE-2019-9011, CVE-2019-9013, CVE-2020-10245, CVE-2020-12067, CVE-2020-12068, CVE-2020-12069, CVE-2020-15806, CVE-2021-29241, CVE-2021-29242, CVE-2021-33485, CVE-2021-36763, CVE-2021-36764, CVE-2022-22513, CVE-2022-22514, CVE-2022-22515, CVE-2022-22517, CVE-2022-22519: No fix planned. This issue will be handled with next hardware generation release.
Vulnerabilities 33
-
Critical 9.8
CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.
-
High 8.1
A component of the CODESYS Control runtime system allows read and write access to configuration files
A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.
-
High 7.8
CODESYS V3 prone to Inadequate Password Hashing
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain ful…
-
High 7.5
An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Sol…
-
High 7.5
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed …
-
High 7.5
CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).
-
High 7.5
Communication Components in multiple CODESYS products vulnerable to communication channel disruption
An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed.
-
High 7.5
Special HTTP(s) Requests can cause a buffer-read causing a crash of the webserver and the runtime system.
A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system.
-
High 7.1
Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS.
An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to local overwriting of memory in the CmpTraceMgr, whereby the attacker can neither gain the values read internally nor cont…
-
Medium 6.5
Null Pointer Dereference in multiple CODESYS products can lead to a DoS.
An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash.
-
Medium 5.3
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid us…
-
Unscored —
Untrusted search path vulnerability in the pthread_win32_process_attach_np function in pthreadGC2.dll in Pthreads-win32…
-
Unscored —CVE-2017-3735 EPSS 21%
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This woul…
-
Unscored —CVE-2018-0739 EPSS 19%
Constructed ASN.1 types with a recursive definition could exceed the stack
Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL…
-
Unscored —
In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and c…
-
Unscored —
Use of Insufficiently Random Values exists in CODESYS V3 products versions prior V3.5.14.0.
-
Unscored —
Improper Communication Address Filtering exists in CODESYS V3 products versions prior V3.5.14.0.
-
Unscored —
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requ…
-
Unscored —
3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to sen…
-
Unscored —
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requ…
-
Unscored —
CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow.
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to cras…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory …
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which re…
-
Unscored —
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.
-
Unscored —
An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu ar…
-
Unscored —
CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.
-
Unscored —
CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a …
-
Unscored —
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication …
-
Unscored —
In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.
-
Unscored —
In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a…
Revision history
-
#1.0.3
Add missing CWE values for vulnerabilities. Add missing CVSS 3.0 score for CVE-2010-5250.
-
#1.0.2
Adjusted to VDE template. Changed title from 'Festo Controller CECC-S,-LK,-D Family Firmware <= 2.3.8.1 - Multiple Vulnerabilities in CODESYS V3 Runtime System' to 'Festo: Controller CECC-S,LK,D family <= 2.3.8.1 - multiple vulnerabilities in CODESYS V3 runtime system'. Updated legal disclaimer to add references to special provisions.
-
#1.0.1
Adjust link to VDE Advisory, TLP and update some CVE information, where CVSS was not known before.
-
#1.0.0
Initial revision.
References
-
FSA-202202: Festo: Controller CECC-S,LK,D family <= 2.3.8.1 - multiple vulnerabilities in CODESYS V3 runtime system - HTML
https://certvde.com/en/advisories/VDE-2022-022/
-
For further security-related issues in Festo products please contact the Festo Product Security Incident Response Team (PSIRT)
https://festo.com/psirt
-
CERT@VDE Security Advisories
https://certvde.com/en/advisories/vendor/festo/