Description
In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gateway password.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CODESYS | CODESYS Gateway Server V2 | V2 – < V2.3.9.38 | V2.3.9.38 |
Advisories 3
- FSA-202406 Several Codesys Gateway v2 vulnerabilities in Codesys provided by Festo CERT@VDE · Dec 3, 2024
- ICSA-25-182-03 FESTO CODESYS CISA ICS & IT advisories · Dec 3, 2024
- VDE-2022-040 WAGO: Multiple Vulnerabilities in Controller with WAGO I/O-Pro / CODESYS 2.3 Runtime CERT@VDE · Sep 22, 2023