Summary
Several high severity vulnerabilities in CODESYS V3 affecting Festo products could lead to Remote Code Execution or Denial of Service.
Details
Impact
Please check the references in the CVEs.
Mitigation
As part of a security strategy, Festo recommends the following general defense measures to reduce the risk of exploits:
- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside
- Use firewalls to protect and separate the control system network from other networks
- Use VPN (Virtual Private Networks) tunnels if remote access is required
Activate and apply user management and password features
- Use encrypted communication links
- Limit the access to both development and control system by physical means, operating system features, etc.
- Protect both development and control system by using up to date virus detecting solutions
Festo strongly recommends to minimize and protect network access to connected devices with state of the art techniques and processes.
For a secure operation follow the recommendations in the product manuals.
Remediation
For all vulnerability identifiers except CECC-D, CECC-D-CS, CECC-D-BA, CECC-S, CECC-X Gen3 and CECC-LK: Update planned end of Q3 2024.
Vulnerabilities 16
-
High 8.8
CODESYS: Multiple products prone to out-of-bounds write
An authenticated, remote attacker may use a out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into memory which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
-
High 8.8
CODESYS: Multiple products prone to out-of-bounds write
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execut…
-
High 8.8
CODESYS: Multiple products prone to stack based out-of-bounds write
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code executi…
-
High 8.8
CODESYS: Multiple products prone to stack based out-of-bounds write
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwr…
-
High 8.8
CODESYS: Multiple products prone to stack based out-of-bounds write
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overw…
-
High 8.8
CODESYS: Multiple products prone to stack based out-of-bounds write
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwr…
-
High 8.8
CODESYS: Multiple products prone to stack based out-of-bounds write
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overw…
-
High 8.8
CODESYS: Multiple products prone to stack based out-of-bounds write
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overw…
-
High 8.8
CODESYS: Multiple products prone to stack based out-of-bounds write
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwr…
-
High 8.8
CODESYS: Multiple products prone to stack based out-of-bounds write
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overw…
-
High 8.8
CODESYS: Multiple products prone to stack based out-of-bounds write
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overw…
-
High 8.8
CODESYS: Multiple products prone to stack based out-of-bounds write
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overw…
-
High 7.5
CODESYS: Multiple products prone to Improper Input Validation
In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service.
-
Medium 6.5
CODESYS: Multiple products prone to Improper Input Validation
Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vulnerability leading to a denial-of-service condition.
-
Medium 6.5
CODESYS: Multiple products prone to Improper Input Validation
An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions to read from an invalid address which can lead to a denial-of-service condition.
-
Medium 6.5
CODESYS: Multiple products prone to improperly restricted memory operations
An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products to force a denial-of-service situation.
Revision history
-
#1.0.1
Adjusted to VDE template. Changed title from "Several Codesys Vulnerabilities in Festo Products" to "Festo: Multiple products contain CoDe16 vulnerability". Updated legal disclaimer to add references to special provisions.
-
#1.0.0
Initial revision.
References
-
FSA-202401: Festo: Multiple products contain CoDe16 vulnerability - HTML
https://certvde.com/en/advisories/VDE-2023-063/
-
For further security-related issues in Festo products please contact the Festo Product Security Incident Response Team (PSIRT)
https://festo.com/psirt
-
CERT@VDE Security Advisories for Festo SE & Co. KG
https://certvde.com/en/advisories/vendor/festo/