Most recent entries from all

9AKK108470A9491 — ABB ACS880 +N8010 Drives CODESYS RTS Vulnerabilities

Multiple vulnerabilities regarding the CODESYS Runtime System from CODESYS Group have been publicly reported. CODESYS Runtime System is utilized in the firmware of ABB ACS880 drives to provide IEC 61131-3 programming capabilities.

These vulnerabilities could lead to out-of-bound memory access. Successful exploit may result in a denial-of-service condition or arbitrary code execution. Firmware updates are available that mitigate the publicly reported vulnerabilities of the product versions listed as affected in this advisory.

bdu:2023-03155

certfr-2023-avi-0297 — De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permetten…

certfr-2023-avi-0297

EUVD-2026-322768

fkie_cve-2022-4046

In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device.

FSA-202601 — Several CODESYS vulnerabilities in Festo Automation Suite

Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently.

This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite.

Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

GHSA-w93c-fgm5-qf42

In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device.

gsd-2022-4046

ICSA-25-093-03 — ABB ACS880 Drives Containing CODESYS RTS

SEVD-2023-101-01 — CODESYS Runtime Vulnerabilities

Schneider Electric is aware of multiple vulnerabilities disclosed on CODESYS Runtime. Many vendors, including Schneider Electric, embed CODESYS in their offers. If successfully exploited, these vulnerabilities could result in a denial of service or, in some cases, in remote code execution on PacDrive controllers, Modicon Controllers M241 / M251 / M262 / M258 / LMC058 / M218 and HMISCU products. Failure to apply the mitigations provided below may risk Logic Integrity and Permissions attacks, which could result in loss of controllers’ integrity. January 2024 Update: A remediation is available for CVE-2022-4224 for Harmony HMISCU Controller, Modicon Controllers M241 / M251 / M262 and PacDrive Controllers LMC Eco/Pro/Pro2.

VDE-2023-025 — CODESYS: Control runtime system memory and integrity check vulnerabilities

The CODESYS Control V3 runtime system does not restrict the memory accesses of the PLC application code to the PLC application data and does not sufficiently check the integrity of the application code by default. This could be exploited by authenticated PLC programmers.

WID-SEC-W-2024-0943 — CODESYS: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in CODESYS ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder einen Brute-Force-Angriff durchzuführen.