VDE-2024-072 — WAGO: Vulnerabilities in CODESYS Control

Summary

The following firmware versions installed on several devices are vulnerable due to a vulnerability in the CODESYS Control V3 web server.

Details

Impact
The configuration UI called web based management is part of the control runtime system and is also used for the visualization of running applications. Because the web server does not correctly check the return value of an underlying function, it reacts in a wrong way to specifically crafted TLS packets that are received via an HTTPS connection. This causes the web server to access invalid memory and the web server task to crash.

Remediation
Update to Firmware version 01.04.07 (FW4).

Vulnerabilities 1

High 7.5

CVE-2024-8175

CODESYS: web server vulnerable to DoS

An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS.

CODESYS CODESYS Control for PFC200 SL CODESYS Control for Raspberry Pi SL CODESYS Control for emPC-A/iMX6 SL Linux ICS / OT

Sep 25, 2024

Revision history

2024-12-03 #1
Initial revision.

References

CERT@VDE Security Advisories for WAGO
https://certvde.com/de/advisories/vendor/wago/
VDE-2024-072: WAGO: Vulnerabilities in CODESYS Control - HTML
https://certvde.com/en/advisories/VDE-2024-072