#VU107057 Improper validation of integrity check value in CODESYS products - CVE-2023-28355

Vulnerability identifier: #VU107057

Vulnerability risk: Medium

CVSSv4.0: 2.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28355

CWE-ID: CWE-354

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
CODESYS Control for BeagleBone SL
Client/Desktop applications / Other client software
CODESYS Control for emPC-A/iMX6 SL
Client/Desktop applications / Other client software
CODESYS Control for IOT2000 SL
Client/Desktop applications / Other client software
CODESYS Control for Linux SL
Client/Desktop applications / Other client software
CODESYS Control for PFC100 SL
Client/Desktop applications / Other client software
CODESYS Control for PFC200 SL
Client/Desktop applications / Other client software
CODESYS Control for PLCnext SL
Client/Desktop applications / Other client software
CODESYS Control for Raspberry Pi SL
Client/Desktop applications / Other client software
CODESYS Control for WAGO Touch Panels 600 SL
Client/Desktop applications / Other client software
CODESYS Control Runtime System Toolkit
Client/Desktop applications / Other client software
CODESYS Control RTE (for Beckhoff CX) SL
Other software / Other software solutions
CODESYS Control RTE (SL)
Other software / Other software solutions
CODESYS Control Win (SL)
Other software / Other software solutions
CODESYS HMI (SL)
Other software / Other software solutions

Vendor: CODESYS

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper validation of integrity check value. A remote user can modify files on the target system.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

CODESYS Control for BeagleBone SL: All versions

CODESYS Control for emPC-A/iMX6 SL: All versions

CODESYS Control for IOT2000 SL: All versions

CODESYS Control for Linux SL: All versions

CODESYS Control for PFC100 SL: All versions

CODESYS Control for PFC200 SL: All versions

CODESYS Control for PLCnext SL: All versions

CODESYS Control for Raspberry Pi SL: All versions

CODESYS Control for WAGO Touch Panels 600 SL: All versions

CODESYS Control RTE (for Beckhoff CX) SL: All versions

CODESYS Control RTE (SL): All versions

CODESYS Control Runtime System Toolkit: All versions

CODESYS Control Win (SL): All versions

CODESYS HMI (SL): All versions

---

External links
https://cert.vde.com/en/advisories/VDE-2023-025/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.