Vendor
CODESYS
104 known vulnerabilities.
Products
104 results · Feed
-
High 8.8
CODESYS Runtime System prone to heap based buffer overflow
In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-service condition or memory overwrite. User interaction is not required.
-
Medium 6.5
Codesys runtime systems: Access of uninitialised pointer lead to denial of service.
In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-of-service. User interaction is not required.
-
Critical 9.8
Insecure default settings in CODESYS Runtime Toolkit 32 bit full and CODESYS PLCWinNT
In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller.
-
High 7.5
Insecure transmission of credentials
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.
-
High 7.5
CODESYS Gateway server prone to denial of service attack due to excessive memory allocation
The CODESYS Gateway Server V2 does not verifiy that the size of a request is within expected limits. An unauthenticated attacker may allocate an arbitrary amount of memory, which may lead to a crash of the Gateway due to an out-of-memory condition.
-
Medium 5.3
CODESYS Gateway Server V2 prone to Denial of Service Attack
In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP connections and prevent legitimate users or clients from establishing a new connection to the CODESYS…
-
Critical 9.8
Partial string comparison in CODESYS gateway server
In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding …
-
High 8.1
CODESYS runtime system prone to file deletion due to improper error handling
Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction…
-
High 7.5
Special HTTP(s) Requests can cause a buffer-read causing a crash of the webserver and the runtime system.
A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system.
-
Medium 6.5
A bug in the CODESYS V3 CmpUserMgr component fails to correctly apply a security policy.
A bug in CmpUserMgr component can lead to only partially applied security policies. This can result in enabled, anonymous access to components part of the applied security policy.
-
High 7.5
Communication Components in multiple CODESYS products vulnerable to communication channel disruption
An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed.
-
High 7.8
CODESYS driver SysDrv3S allows SYSTEM users on Microsoft Windows to read and write in restricted memory space.
The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space.
-
High 8.1
A component of the CODESYS Control runtime system allows read and write access to configuration files
A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.
-
High 7.1
Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS.
An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to local overwriting of memory in the CmpTraceMgr, whereby the attacker can neither gain the values read internally nor cont…
-
Medium 6.5
Null Pointer Dereference in multiple CODESYS products can lead to a DoS.
An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash.
-
High 7.4
Improper Certificate Validation in CODESYS Git
Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate validation by default, so it does not verify that the server provides a valid and trusted HTTPS certific…
-
Medium 6.5
CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service
A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition.
-
High 8.1
CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service
A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite.
-
High 7.5
CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication…
-
High 7.5CVE-2021-34586 EPSS 14%
CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS)
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service condition.
-
High 7.5
CODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS)
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an invalid address can occur. This leads to a denial of service sit…
-
Critical 9.1
CODESYS V2 web server: crafted requests could trigger a buffer over-read (DoS)
Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
-
High 7.5
CODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS)
Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
-
Unscored —
Multiple heap-based buffer overflows in 3S-Smart CODESYS Gateway Server before 2.3.9.34 allow remote attackers to execu…