Summary
Ein Angreifer kann mehrere Schwachstellen in CODESYS Control Runtime und Gateway Client ausnutzen, um Daten zu manipulieren und einen Denial-of-Service-Zustand herbeizuführen.
Product
CODESYS ist eine herstellerunabhängige Automatisierungssoftware für die Entwicklung von Steuerungsanwendungen in der industriellen Automatisierung.
Vulnerabilities 2
-
High 8.1
Improper Synchronization in Monitoring in CODESYS Control Runtime
Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacke…
-
High 7.5
Uncontrolled Memory Allocation in CODESYS Gateway Client
The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory cons…
Revision history
-
#1
Initiale Fassung
References
-
CODESYS Security Advisory 2026-12 vom 2026-10-01
https://api-www.codesys.com/fileadmin/user_upload/CODESYS_Group/Ecosystem/Up-to-Date/Security/Security-Advisories/Advisory2026-12_CDS-94929.pdf
-
CODESYS Security Advisory 2026-11 vom 2026-10-01
https://api-www.codesys.com/fileadmin/user_upload/CODESYS_Group/Ecosystem/Up-to-Date/Security/Security-Advisories/Advisory2026-11_CDS-98296.pdf