Share: Email | Twitter

ID

VDE-2022-027

Published

2022-07-18 12:00 (CEST)

Last update

2022-07-18 11:19 (CEST)

Vendor(s)

Festo SE & Co. KG

Product(s)

Article No° Product Name Affected Version(s)
574415 Controller CECC-D = R07 (07.06.2021) = 2.4.2.0
574418 Controller CECC-LK = R07 (07.06.2021) = 2.4.2.0
574416 Controller CECC-S = R07 (07.06.2021) = 2.4.2.0

Summary

The Festo controller CECC product family in firmware version 2.4.2.0 is affected by multiple vulnerabilities in the CODESYS V3 runtime.

Vulnerabilities



Weakness
Out-of-bounds Write (CWE-787)
Summary

CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.

Weakness
Out-of-bounds Write (CWE-787)
Summary

CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.

Weakness
Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
Summary

An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insufficiently protected during transport. All variants of the ...

Weakness
Exposure of Resource to Wrong Sphere (CWE-668)
Summary

A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the ...

Weakness
Files or Directories Accessible to External Parties (CWE-552)
Summary

In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.

Weakness
NULL Pointer Dereference (CWE-476)
Summary

In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer dereference in the affected CODESYS products and may result in ...

Weakness
NULL Pointer Dereference (CWE-476)
Summary

CODESYS Gateway 3 before 3.5.17.0 has a NULL pointer dereference that may result in a denial of service (DoS).

Weakness
Buffer Over-read (CWE-126)
Summary

The CODESYS web server is used by the CODESYS WebVisu to display CODESYS visualization screens in a web browser. Specific crafted HTTP or HTTPS requests may cause an internal buffer ...

Weakness
Small Space of Random Values (CWE-334)
Summary

An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed.

Weakness
Missing Release of Memory after Effective Lifetime (CWE-401)
Summary

CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.

Weakness
Out-of-bounds Write (CWE-787)
Summary

An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService. A specially crafted packet can cause a large memcpy, resulting in an ...

Weakness
Improper Input Validation (CWE-20)
Summary

CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low ...

Weakness
Untrusted Pointer Dereference (CWE-822)
Summary

An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to local overwriting of memory in the CmpTraceMgr, whereby the ...

Weakness
NULL Pointer Dereference (CWE-476)
Summary

An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash.

Weakness
Insufficient Information (NVD-CWE-noinfo)
Summary

An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu are susceptible to privilege escalation.

Severity
-
Weakness
-
Summary

The hashing procedure used to save passwords is inadequate.

Source
codesys.com 
Severity
-
Weakness
-
Summary

This vulnerability enables valid user names to be identified.

Source
codesys.com 
Severity
-
Weakness
-
Summary

The user password can be changed without having to enter the original password.

Source
codesys.com 

Impact

By using the listed vulnerabilities an unauthorized remote attacker may gain full access to the devices or make them unavailable.

Solution

Remediation

No fix planned. This issue will be handled with next hardware generation release.

General recommendations

Festo strongly recommends to minimize and protect network access to connected devices with state of the art techniques and processes.
Festo also highly recommends to apply available firmware updates containig security related changes as soon as possible.
For a secure operation follow the recommendations in the product manuals.
Until Festo provides a firmware-update with CODESYS runtime patching the vulnerabilities general recommendation is to:

  1. Do not use the Codesys Web server of the Web-visualization.
  2. The access to a PLC with an active webserver should be restricted on network level to participants for whom it is strictly necessary. Also, the PLC should never be exposed to the internet. Assist IT staff to block access (from outside of company network or from outside of virtual network assigned to machines) to PLC through existing network equipment (routers, firewalls etc) by blocking specific ports and protocols (UDP, TCP).
  3. PLC with WEB server active shall only include visualization screens in the application that are intended for being accessed by operators of the CODESYS WebVisu and the CODESYS Remote TargetVisu.
  4. Activation of the Codesys device user management and visualization user management if Web visualization is used.
    • With the activation of the user management on the device any online service requires an appropriate authentication. It is highly recommended to setup at least one administrator user. Moreover, a set of users belonging to the appropriate groups allow maintaining leveled access rights.
    • Use the protection of the user management in the CODESYS visualization not only for the navigation elements but also for all elements that should be restricted to certain operators only.

As part of a security strategy, Festo supports the CODESYS GmbH recommended following general defense measures to reduce the risk of exploits:

  • Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside
  • Use firewalls to protect and separate the control system network from other networks - Use VPN (Virtual Private Networks) tunnels if remote access is required
  • Activate and apply user management and password features
  • Use encrypted communication links
  • Limit the access to both development and control system by physical means, operating system features, etc.
  • Protect both development and control system by using up to date virus detecting solutions

For more information and general recommendations for protecting machines and plants, see also the CODESYS Security Whitepaper: customers.codesys.com/fileadmin/data/customers/security/CODESYS-Security-Whitepaper.pdf

Reported by

Festo SE & Co. KG thanks the following parties for their efforts:

  • CERT@VDE for coordination and support with this publication