Resource exhaustion in CODESYS products - CVE-2020-7052

Vulnerability identifier: #VU24801

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-7052

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to uncontrolled memory allocation in affected products containing communication servers for the CODESYS communication protocol. A remote authenticated attacker can send a specially crafted request, trigger resource exhaustion and perform a denial of service (DoS) attack.

CODESYS Control for BeagleBone
CODESYS Control for emPC-A/iMX6
CODESYS Control for IOT2000
CODESYS Control for Linux
CODESYS Control for PLCnext
CODESYS Control for PFC100
CODESYS Control for PFC200
CODESYS Control for Raspberry Pi
CODESYS Control RTE V3
CODESYS Control RTE V3 (for Beckhoff CX)
CODESYS Control Win V3 (part of the CODESYS Development System setup)
CODESYS Control V3 Runtime System Toolkit
CODESYS V3 Safety SIL2
CODESYS Gateway V3
CODESYS HMI V3
CODESYS V3 Simulation Runtime (part of the CODESYS Development System)

Install updates from vendor's website.

CODESYS Control for BeagleBone - update to 3.5.15.30
CODESYS Control for emPC-A/iMX6 - update to 3.5.15.30
CODESYS Control for IOT2000 - update to 3.5.15.30
CODESYS Control for Linux - update to 3.5.15.30
CODESYS Control for PLCnext - update to 3.5.15.30
CODESYS Control for PFC100 - update to 3.5.15.30
CODESYS Control for PFC200 - update to 3.5.15.30
CODESYS Control for Raspberry Pi - update to 3.5.15.30
CODESYS Control RTE V3 - update to 3.5.15.30
CODESYS Control RTE V3 (for Beckhoff CX) - update to 3.5.15.30
CODESYS Control Win V3 (part of the CODESYS Development System setup) - update to 3.5.15.30
CODESYS Control V3 Runtime System Toolkit - update to 3.5.15.30
CODESYS V3 Safety SIL2 - update to 3.5.15.30
CODESYS Gateway V3 - update to 3.5.15.30
CODESYS HMI V3 - update to 3.5.15.30
CODESYS V3 Simulation Runtime (part of the CODESYS Development System) - update to 3.5.15.30

• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12977&token=33f948eed0c2fd69d238d9515779be337ef7592d&download=
• https://www.tenable.com/security/research/tra-2020-04
• https://github.com/tenable/poc/blob/master/codesys/codesys_gateway_v3_config_modification_tra_2020_0...

• Denial of service in several CODESYS V3 products