Summary
The Festo controller CECC product family in firmware version 2.4.2.0 is affected by multiple vulnerabilities in the CODESYS V3 runtime.
Details
Impact
By using the listed vulnerabilities an unauthorized remote attacker may gain full access to the devices or make them unavailable.
Remediation
No fix planned. This issue will be handled with next hardware generation release.
Vulnerabilities 18
-
Critical 9.8
CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.
-
High 8.1
A component of the CODESYS Control runtime system allows read and write access to configuration files
A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.
-
High 7.8
CODESYS V3 prone to Inadequate Password Hashing
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain ful…
-
High 7.5
An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Sol…
-
High 7.5
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed …
-
High 7.5
CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).
-
High 7.5
Communication Components in multiple CODESYS products vulnerable to communication channel disruption
An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed.
-
High 7.5
Special HTTP(s) Requests can cause a buffer-read causing a crash of the webserver and the runtime system.
A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system.
-
High 7.1
Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS.
An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to local overwriting of memory in the CmpTraceMgr, whereby the attacker can neither gain the values read internally nor cont…
-
Medium 6.5
Null Pointer Dereference in multiple CODESYS products can lead to a DoS.
An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash.
-
Medium 5.3
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid us…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which re…
-
Unscored —
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.
-
Unscored —
An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu ar…
-
Unscored —
CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.
-
Unscored —
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication …
-
Unscored —
In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.
-
Unscored —
In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a…
Revision history
-
#1.0.2
Adjusted to VDE template. Changed document title from 'Festo Controller CECC-S,-LK,-D Family Firmware = 2.4.2.0 - Multiple Vulnerabilities in CODESYS V3 Runtime System' to' Festo: Controller CECC-S,LK,D family firmware 2.4.2.0 - multiple vulnerabilities in CODESYS V3 runtime system'. Updated legal disclaimer to add references to special provisions.
-
#1.0.1
Adjust link to VDE Advisory, TLP and update some CVE information, where CVSS was not known before.
-
#1.0.0
Initial version.
References
-
FSA-202203: Festo: Controller CECC-S,LK,D family firmware 2.4.2.0 - multiple vulnerabilities in CODESYS V3 runtime system - HTML
https://certvde.com/en/advisories/VDE-2022-027/
-
For further security-related issues in Festo products please contact the Festo Product Security Incident Response Team (PSIRT)
https://festo.com/psirt
-
CERT@VDE Security Advisories for Festo SE & Co. KG
https://certvde.com/en/advisories/vendor/festo/