Share: Email | Twitter

ID

VDE-2022-027

Published

2022-07-18 12:00 (CEST)

Last update

2022-07-18 11:19 (CEST)

Vendor(s)

Festo SE & Co. KG

Product(s)

Article No┬░ Product Name Affected Version(s)
574415 Controller CECC-D = R07 (07.06.2021) = 2.4.2.0
574418 Controller CECC-LK = R07 (07.06.2021) = 2.4.2.0
574416 Controller CECC-S = R07 (07.06.2021) = 2.4.2.0

Summary

The Festo controller CECC product family in firmware version 2.4.2.0 is affected by multiple vulnerabilities in the CODESYS V3 runtime.

Vulnerabilities



Last Update
May 25, 2022, 4:22 p.m.
Weakness
Out-of-bounds Write (CWE-787)
Summary

CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.

Last Update
May 25, 2022, 4:24 p.m.
Weakness
Out-of-bounds Write (CWE-787)
Summary

CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.

Last Update
Feb. 15, 2022, 9:47 a.m.
Weakness
Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
Summary

An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insufficiently protected during transport. All variants of the following CODESYS V3 products in all versions containing the CmpUserMgr component are affected regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS V3 Simulation Runtime (part of the CODESYS Development System), CODESYS Control V3 Runtime System Toolkit, CODESYS HMI V3.

Last Update
May 25, 2022, 4:26 p.m.
Weakness
Exposure of Resource to Wrong Sphere (CWE-668)
Summary

A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.

Last Update
May 25, 2022, 4:24 p.m.
Weakness
Files or Directories Accessible to External Parties (CWE-552)
Summary

In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.

Last Update
Nov. 17, 2022, 1:09 p.m.
Weakness
NULL Pointer Dereference (CWE-476)
Summary

In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer dereference in the affected CODESYS products and may result in a denial-of-service condition.

Last Update
Nov. 17, 2022, 1:09 p.m.
Weakness
NULL Pointer Dereference (CWE-476)
Summary
CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).
Last Update
May 25, 2022, 4:30 p.m.
Weakness
Buffer Over-read (CWE-126)
Summary

The CODESYS web server is used by the CODESYS WebVisu to display CODESYS visualization screens in a web browser. Specific crafted HTTP or HTTPS requests may cause an internal buffer over-read, which could crash the web server task of the CODESYS Control runtime system.

Last Update
May 25, 2022, 4:27 p.m.
Weakness
Small Space of Random Values (CWE-334)
Summary

An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed.

Last Update
May 16, 2022, 12:19 p.m.
Weakness
Missing Release of Memory after Effective Lifetime (CWE-401)
Summary

CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.

Last Update
Sept. 8, 2021, 8:50 a.m.
Weakness
Out-of-bounds Write (CWE-787)
Summary

An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService. A specially crafted packet can cause a large memcpy, resulting in an access violation and termination of the process. An attacker can send a packet to a device running the GatewayService.exe to trigger this vulnerability. All variants of the CODESYS V3 products in all versions prior V3.5.16.10 containing the CmpRouter or CmpRouterEmbedded component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PLCnext, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS Control V3 Runtime System Toolkit, CODESYS V3 Embedded Target Visu Toolkit, CODESYS V3 Remote Target Visu Toolkit, CODESYS V3 Safety SIL2, CODESYS Edge Gateway V3, CODESYS Gateway V3, CODESYS HMI V3, CODESYS OPC Server V3, CODESYS PLCHandler SDK, CODESYS V3 Simulation Runtime (part of the CODESYS Development System).

Last Update
Sept. 8, 2021, 8:49 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.

Last Update
May 25, 2022, 4:26 p.m.
Weakness
Untrusted Pointer Dereference (CWE-822)
Summary

An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to local overwriting of memory in the CmpTraceMgr, whereby the attacker can neither gain the values read internally nor control the values to be written. If invalid memory is accessed, this results in a crash.

Last Update
May 25, 2022, 4:25 p.m.
Weakness
NULL Pointer Dereference (CWE-476)
Summary

An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash.

Last Update
May 25, 2022, 4:23 p.m.
Weakness
Insufficient Information (NVD-CWE-noinfo)
Summary

An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu are susceptible to privilege escalation.

Last Update
July 18, 2022, 11:13 a.m.
Severity
-
Weakness
-
Summary

The hashing procedure used to save passwords is inadequate.

Last Update
Feb. 15, 2022, 9:48 a.m.
Severity
-
Weakness
-
Summary

This vulnerability enables valid user names to be identified.

Last Update
Feb. 15, 2022, 9:46 a.m.
Severity
-
Weakness
-
Summary

The user password can be changed without having to enter the original password.

Impact

By using the listed vulnerabilities an unauthorized remote attacker may gain full access to the devices or make them unavailable.

Solution

Remediation

No fix planned. This issue will be handled with next hardware generation release.

General recommendations

Festo strongly recommends to minimize and protect network access to connected devices with state of the art techniques and processes.
Festo also highly recommends to apply available firmware updates containig security related changes as soon as possible.
For a secure operation follow the recommendations in the product manuals.
Until Festo provides a firmware-update with CODESYS runtime patching the vulnerabilities general recommendation is to:

  1. Do not use the Codesys Web server of the Web-visualization.
  2. The access to a PLC with an active webserver should be restricted on network level to participants for whom it is strictly necessary. Also, the PLC should never be exposed to the internet. Assist IT staff to block access (from outside of company network or from outside of virtual network assigned to machines) to PLC through existing network equipment (routers, firewalls etc) by blocking specific ports and protocols (UDP, TCP).
  3. PLC with WEB server active shall only include visualization screens in the application that are intended for being accessed by operators of the CODESYS WebVisu and the CODESYS Remote TargetVisu.
  4. Activation of the Codesys device user management and visualization user management if Web visualization is used.
    • With the activation of the user management on the device any online service requires an appropriate authentication. It is highly recommended to setup at least one administrator user. Moreover, a set of users belonging to the appropriate groups allow maintaining leveled access rights.
    • Use the protection of the user management in the CODESYS visualization not only for the navigation elements but also for all elements that should be restricted to certain operators only.

As part of a security strategy, Festo supports the CODESYS GmbH recommended following general defense measures to reduce the risk of exploits:

  • Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside
  • Use firewalls to protect and separate the control system network from other networks - Use VPN (Virtual Private Networks) tunnels if remote access is required
  • Activate and apply user management and password features
  • Use encrypted communication links
  • Limit the access to both development and control system by physical means, operating system features, etc.
  • Protect both development and control system by using up to date virus detecting solutions

For more information and general recommendations for protecting machines and plants, see also the CODESYS Security Whitepaper: customers.codesys.com/fileadmin/data/customers/security/CODESYS-Security-Whitepaper.pdf

Reported by

Festo SE & Co. KG thanks the following parties for their efforts:

  • CERT@VDE for coordination and support with this publication