Summary
The TruControl laser control software (versions 1.04 to 3.0.0) uses CODESYS runtime versions affected by multiple CVEs:
**CVE list:**
- CVE-2021-29242
- CVE-2021-29241
- CVE-2019-5105
- CVE-2020-7052
- CVE-2019-9012
- CVE-2019-9010
- CVE-2019-9009
- CVE-2018-10612
In addition to the CVEs listed above, the affected products are also vulnerable to the following issues without a CVE ID:
---
### **CODESYS Advisory 2018-07**
A crafted communication request may cause an access violation in the affected CODESYS products and may result in a denial-of-service condition.
- **CVSS v3.0 base score:** 6.5
- **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
🔗 [Link to advisory](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12928&token=6d1dcea05a15aeef7ad48eadc64c8eca5d4f07b2&download=)
---
### **CODESYS Advisory 2018-04**
The CODESYS runtime system allows access to files outside the restricted working directory of the controller by online services.
- **CVSS v3.0 base score:** 9.9
- **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
🔗 [Link to advisory](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12925&token=50e7240fa947ea215311e3db441f82152f1109b6&download=)
---
### **CODESYS Advisory 2017-03**
A crafted request may cause an access violation in the affected CODESYS products and may result in a denial-of-service condition.
- **CVSS v3.0 base score:** 7.5
- **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
🔗 [Link to advisory](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12912&token=2f23e7f047c2768dd06fdf072de49a7ba1fe9687&download=)
Details
Impact
To be able to exploit this vulnerability the attacker first needs to gain any kind of network access to the system.
When the system is reachable over the network these vulnerabilities can be exploited with following possible impacts/damages to the system:
- Data loss in the laser control
- Standstill of production
- Damage by change of the laser control
- Interception of sensitive data
Safety is not affected since it is controlled by an independent electromechanical safety mechanism.
Remediation
- We highly recommend updating to TruControl version 3.16.0 or higher as soon as possible
- Please contact your service partner (service.tls@trumpf.com) for immediate instructions on how to retrieve the update
Vulnerabilities 8
-
High 7.5
An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Sol…
-
High 7.5
CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).
-
Unscored —
In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and c…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to cras…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory …
-
Unscored —
CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a …
-
Unscored —
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication …
Revision history
-
#1
initial revision
References
-
TRUMPF Laser SE - PSIRT
https://www.trumpf.com/en_US/meta/security-with-trumpf/security-advisories/
-
CERT@VDE Security Advisories
https://certvde.com/en/advisories/vendor/trumpf-laser/
-
VDE-2021-033: TRUMPF Laser GmbH: multiple products prone to codesys runtime vulnerabilities - HTML
https://certvde.com/en/advisories/VDE-1900-0815/