Summary
Schneider Electric is aware of multiple vulnerabilities disclosed by Codesys on CODESYS V2 runtime for industrial control systems, which is used in its Programmable Automation Controller (PacDrive) M products.
The Programmable Automation Controller (PacDrive) M products are legacy logic motion technology for packaging and production machines.
Failure to apply the mitigations provided below may risk buffer overflow attacks, which could result in potential denial of service condition or arbitrary remote code execution.
Vulnerabilities 3
-
Unscored —
CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.
-
Unscored —
CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.
-
Unscored —
CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.
Revision history
-
#1.0.0
Original Release
References
-
CODESYS V2 Vulnerabilities in Programmable Automation Controller (PacDrive) M - SEVD-2021-222-06 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-06&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-222-06_CODESYS_V2_Vulnerabilities_in_PacDrive%20M_Security_Notification.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/