Multiple vulnerabilities in CODESYS Control Products

Published: 2018-12-19

Risk	Low
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2018-20025 CVE-2018-20026 CVE-2018-10612
CWE-ID	CWE-330 CWE-923 CWE-284
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	CODESYS Simulation Runtime Client/Desktop applications / Other client software CODESYS Development System Client/Desktop applications / Other client software CODESYS PLCHandler SDK Client/Desktop applications / Other client software CODESYS OPC Server Client/Desktop applications / Other client software CODESYS HMI Client/Desktop applications / Other client software CODESYS Gateway Client/Desktop applications / Other client software CODESYS Safety SIL2 Client/Desktop applications / Other client software CODESYS Remote Target Visu Toolkit Client/Desktop applications / Other client software CODESYS Embedded Target Visu Toolkit Client/Desktop applications / Other client software CODESYS Control Runtime System Toolkit Client/Desktop applications / Other client software CODESYS Control Win Client/Desktop applications / Other client software CODESYS Control RTE Client/Desktop applications / Other client software CODESYS Control for Raspberry Pi Client/Desktop applications / Other client software CODESYS Control for PFC200 Client/Desktop applications / Other client software CODESYS Control for PFC100 Client/Desktop applications / Other client software CODESYS Control for Linux Client/Desktop applications / Other client software CODESYS Control for IOT2000 Client/Desktop applications / Other client software CODESYS Control for emPC-A/iMX6 Client/Desktop applications / Other client software CODESYS Control for BeagleBone Client/Desktop applications / Other client software
Vendor	CODESYS

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Use of insufficiently random values

EUVDB-ID: #VU16610

Risk: Low

CVSSv3.1: 8.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-20025

CWE-ID: CWE-330 - Use of Insufficiently Random Values

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to weak random values. A remote unauthenticated attacker can bypass security restrictions to affect the confidentiality and integrity of data stored on the device.

Mitigation

Install update from vendor's website.

Vulnerable software versions

CODESYS Simulation Runtime: All versions

CODESYS Development System: All versions

CODESYS PLCHandler SDK: All versions

CODESYS OPC Server: All versions

CODESYS HMI: All versions

CODESYS Gateway: All versions

CODESYS Safety SIL2: All versions

CODESYS Remote Target Visu Toolkit: All versions

CODESYS Embedded Target Visu Toolkit: All versions

CODESYS Control Runtime System Toolkit: All versions

CODESYS Control Win: All versions

CODESYS Control RTE: All versions

CODESYS Control for Raspberry Pi: All versions

CODESYS Control for PFC200: All versions

CODESYS Control for PFC100: All versions

CODESYS Control for Linux: All versions

CODESYS Control for IOT2000: All versions

CODESYS Control for emPC-A/iMX6: All versions

CODESYS Control for BeagleBone: All versions

External links

http://www.codesys.com/security/security-reports.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Spoofing attack

EUVDB-ID: #VU16611

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-20026

CWE-ID: CWE-923 - Improper Restriction of Communication Channel to Intended Endpoints

Exploit availability: No

Description

The vulnerability allows a remote attacker to conduct spoofing attack on the target system.

The vulnerability exists due to the application does not properly restrict communication channels. A remote unauthenticated attacker can spoof the source of communication packets.

Mitigation

Install update from vendor's website.

Vulnerable software versions

CODESYS Simulation Runtime: All versions

CODESYS Development System: All versions

CODESYS PLCHandler SDK: All versions

CODESYS OPC Server: All versions

CODESYS HMI: All versions

CODESYS Gateway: All versions

CODESYS Safety SIL2: All versions

CODESYS Remote Target Visu Toolkit: All versions

CODESYS Embedded Target Visu Toolkit: All versions

CODESYS Control Runtime System Toolkit: All versions

CODESYS Control Win: All versions

CODESYS Control RTE: All versions

CODESYS Control for Raspberry Pi: All versions

CODESYS Control for PFC200: All versions

CODESYS Control for PFC100: All versions

CODESYS Control for Linux: All versions

CODESYS Control for IOT2000: All versions

CODESYS Control for emPC-A/iMX6: All versions

CODESYS Control for BeagleBone: All versions

External links

http://www.codesys.com/security/security-reports.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper access control

EUVDB-ID: #VU16612

Risk: Low

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-10612

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions the target system.

The vulnerability exists due to user access management and communication encryption is not enabled by default. A remote unauthenticated attacker can gain access to the device and sensitive information, including user credentials.

Mitigation

Update the affected products to the version 3.5.14.0.

Vulnerable software versions

CODESYS Control for BeagleBone: All versions

: All versions

CODESYS Control RTE: All versions

: All versions

External links

http://www.codesys.com/security/security-reports.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.