Summary
The software product PMC programming tool from Pilz is based on the software CODESYS Development System from CODESYS GmbH. This software is affected by several vulnerabilities, which an attacker can exploit locally or via the network. This means that, in a worst case, attackers could execute arbitrary program code on the PC on which the PMC programming tool is used.
Details
Impact
In a worst case, attackers could execute arbitrary program code on the PC on which the PMC programming tool is used.
Mitigation
Use a hardware firewall, host-based firewall or comparable measures at network level toprotect against unauthorised network communication with the PC.
Use a virus scanner or other measures to protect against malware.
Only use CODESYS libraries and archives from trusted sources.
Remediation
Installation of the software version 3.5.17
Vulnerabilities 27
-
Critical 9.9
An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH CO…
-
High 8.8
A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CO…
-
High 8.8
A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of…
-
High 8.8
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality …
-
High 8.8
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality …
-
High 8.8
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of …
-
High 8.8
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of COD…
-
High 7.8
CODESYS V3 prone to Inadequate Password Hashing
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain ful…
-
High 7.8
A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionali…
-
High 7.5
An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Sol…
-
High 7.5
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed …
-
High 7.5
CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).
-
Medium 5.3
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid us…
-
Unscored —
3S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to 3.5.16.0, allows the system to displ…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to cras…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which re…
-
Unscored —
Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mech…
-
Unscored —
CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted lice…
-
Unscored —
CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in…
-
Unscored —
Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90…
-
Unscored —
This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are …
-
Unscored —
An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back pack…
-
Unscored —
CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a …
-
Unscored —
CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries wi…
-
Unscored —
The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before inst…
-
Unscored —
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication …
-
Unscored —
In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a…
Revision history
-
#1
Initial revision.
References
-
VDE-2021-061: Pilz: PMC programming tool 3.x.x affected by multiple vulnerabilities - HTML
https://certvde.com/en/advisories/VDE-2021-061/
-
Pilz PSIRT
https://www.pilz.com/en-INT/products/industrial-security/security-incident-management
-
CERT@VDE Security Advisories for Pilz GmbH & Co. KG
https://certvde.com/en/advisories/vendor/pilz/