CODESYS: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 7.8
  CVE-2023-5751

  CODESYS: Development system prone to DoS through exposure of resource to wrong sphere

  A local attacker with low privileges can read and modify any users files and cause a DoS in the working directory of the affected products due to exposure of resource to wrong sphere. 

  CODESYS CODESYS Control Win (SL) CODESYS HMI (SL) CODESYS Development System V3 Windows Browsers ICS / OT
  Jun 4, 2024
• High 7.5
  CVE-2024-5000

  CODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA products

  An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.

  CODESYS CODESYS Control for PFC200 SL CODESYS Control for Raspberry Pi SL CODESYS Control for emPC-A/iMX6 SL Linux ICS / OT
  Jun 4, 2024

Revision history

1. 2025-01-07 #2

   Neue Updates aufgenommen

2. 2024-06-03 #1

   Initiale Fassung

References

• VDE CERT Advisoriy vom 2024-06-03
  https://cert.vde.com/de/advisories/VDE-2024-026
• VDE CERT Advisoriy vom 2024-06-03
  https://cert.vde.com/de/advisories/VDE-2024-027
• ABB Security Advisory vom 2025-01-07
  https://search.abb.com/library/Download.aspx?DocumentID=3ADR011377&LanguageCode=en&DocumentPartId=CSAF&Action=Launch