SB2025070226 - Multiple vulnerabilities in FESTO CODESYS Gateway Server V2

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Partial String Comparison (CVE-ID: CVE-2022-31802)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to only part of the specified password is being compared to the real CODESYS Gateway password. A remote attacker can specify a small password that matches the corresponding part of the longer real CODESYS Gateway password and perform authentication on the system.

2) Resource exhaustion (CVE-ID: CVE-2022-31803)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

3) Uncontrolled Memory Allocation (CVE-ID: CVE-2022-31804)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the affected application does not verify the size of a request is within expected limits. A remote attacker can cause a denial of service (DoS) condition on the target system.

Remediation

Install update from vendor's website.

References

• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17141&token=17867e35cfd30c77ba0137f9a17b3a557a4b7b66&download=
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-03