Summary
Several Pilz products use Versions V2 and V3 of the CODESYS runtime system from CODESYS GmbH, which enables the execution of IEC 61131-3 PLC programs. These runtime environments contain several vulnerabilities, which an attacker can exploit via the network. Successful exploitation of the vulnerabilities results in reduced availability and, in a worst case, to the insertion of program code.
Details
The affected products use the CODESYS runtime environment from CODESYS GmbH. Either Version V2 or V3 is active, depending on the configuration. V3 is activated upon delivery. These runtime environments contain the listed vulnerabilities. Some of the vulnerabilities only affect either version V2 or V3 of the CODESYS runtime environment.
Vulnerabilities 18
-
Critical 9.9
An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH CO…
-
High 8.1
CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service
A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite.
-
High 7.8
CODESYS V3 prone to Inadequate Password Hashing
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain ful…
-
High 7.5
An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Sol…
-
High 7.5
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed …
-
High 7.5
CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).
-
High 7.5
CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication…
-
Medium 6.5
CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service
A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition.
-
Medium 5.3
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid us…
-
Unscored —
3S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLC…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to cras…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which re…
-
Unscored —
CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a …
-
Unscored —
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication …
-
Unscored —
CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.
-
Unscored —
CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.
-
Unscored —
CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.
-
Unscored —
In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a…
Revision history
-
#1
Initial revision.
References
-
VDE-2021-054: Pilz: Multiple vulnerabilities in CODESYS V2 and V3 runtime system - HTML
https://certvde.com/en/advisories/VDE-2021-054/
-
Vendor PSIRT
https://www.pilz.com
-
CERT@VDE Security Advisories for Pilz GmbH & Co. KG
https://certvde.com/en/advisories/vendor/pilz/