VDE-2024-026

Vulnerability from csaf_codesysgmbh - Published: 2024-06-04 08:00 - Updated: 2025-05-14 13:00
Summary
CODESYS: Vulnerability can cause a DoS on CODESYS OPC UA products
Notes
Summary: The CODESYS OPC UA stack of the CODESYS Control runtime system may incorrectly calculate the required buffer size for received requests/responses. This can lead to a crash of the CODESYS runtime system during the subsequent initialization of the receive buffer with zero. Update: 10.07.2024 In the Remediation section, the release date of the update has been deleted as the update is now available.
Impact: The CODESYS OPC UA stack, implemented by the CmpOPCUAStack component, is an optional part of the CODESYS runtime system. Both the CODESYS OPC UA Server and the CODESYS OPC UA Client of the CODESYS Control runtime system use the CODESYS OPC UA Stack as a common implementation. The OPC UA protocol enables data exchange between the CODESYS runtime system and OPC UA clients such as SCADA or HMIs, or OPC UA servers such as PLCs or other devices. If a CODESYS runtime system containing the CmpOPCUAStack component receives a specially crafted request/response, the required buffer size in the CODESYS OPC UA server/client may be incorrectly calculated. This can lead to a crash of the CODESYS runtime system during the subsequent initialization of the receive buffer with zero. An attacker can exploit this vulnerability by using a malicious OPC UA client to send a crafted request to CODESYS products with an affected CODESYS OPC UA server. Conversely, CODESYS products with an affected CODESYS OPC UA client can be crashed if they have connected to a malicious OPC UA server. CODESYS Control runtime systems usually contain both the OPC UA client and the server. The CODESYS HMI only includes the OPC UA client.
Mitigation: Starting from version 3.5.15.0 of the affected products, the incorrect calculation of the buffer size can be avoided if the maximum supported array length of the OPC UA stack of the CODESYS Control runtime system is limited to a value of 10129639 or less. This can be achieved by adding the following setting in the CODESYS runtime configuration file (e.g. CODESYSControl.cfg): [CmpOPCUAStack] Stack.MaxArrayLenth=10129639
Remediation: Update the following products to version 3.5.20.10: • CODESYS Control RTE (SL) • CODESYS Control RTE (for Beckhoff CX) SL • CODESYS Control Win (SL) • CODESYS Runtime Toolkit • CODESYS HMI (SL) Update the following products to version 4.12.0.0: • CODESYS Control for BeagleBone SL • CODESYS Control for emPC-A/iMX6 SL • CODESYS Control for IOT2000 SL • CODESYS Control for Linux ARM SL • CODESYS Control for Linux SL • CODESYS Control for PFC100 SL • CODESYS Control for PFC200 SL • CODESYS Control for PLCnext SL • CODESYS Control for Raspberry Pi SL • CODESYS Control for WAGO Touch Panels 600 SL The products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS download area.
CVE-2024-5000
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-131 - Incorrect Calculation of Buffer Size
Mitigation Starting from version 3.5.15.0 of the affected products, the incorrect calculation of the buffer size can be avoided if the maximum supported array length of the OPC UA stack of the CODESYS Control runtime system is limited to a value of 10129639 or less. This can be achieved by adding the following setting in the CODESYS runtime configuration file (e.g. CODESYSControl.cfg): [CmpOPCUAStack] Stack.MaxArrayLenth=10129639
Vendor Fix Update the following products to version 3.5.20.10: • CODESYS Control RTE (SL) • CODESYS Control RTE (for Beckhoff CX) SL • CODESYS Control Win (SL) • CODESYS Runtime Toolkit • CODESYS HMI (SL) Update the following products to version 4.12.0.0: • CODESYS Control for BeagleBone SL • CODESYS Control for emPC-A/iMX6 SL • CODESYS Control for IOT2000 SL • CODESYS Control for Linux ARM SL • CODESYS Control for Linux SL • CODESYS Control for PFC100 SL • CODESYS Control for PFC200 SL • CODESYS Control for PLCnext SL • CODESYS Control for Raspberry Pi SL • CODESYS Control for WAGO Touch Panels 600 SL The products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS download area.
Affected products
Product Identifier Version Remediation
Unresolved product id: CSAFPID-31001 —
Unresolved product id: CSAFPID-31002 —
Unresolved product id: CSAFPID-31003 —
Unresolved product id: CSAFPID-31004 —
Unresolved product id: CSAFPID-31005 —
Unresolved product id: CSAFPID-31006 —
Unresolved product id: CSAFPID-31007 —
Unresolved product id: CSAFPID-31008 —
Unresolved product id: CSAFPID-31009 —
Unresolved product id: CSAFPID-31010 —
Unresolved product id: CSAFPID-31011 —
Unresolved product id: CSAFPID-31012 —
Unresolved product id: CSAFPID-31013 —
Unresolved product id: CSAFPID-31014 —
Unresolved product id: CSAFPID-31015 —
Product Identifier Version Remediation
Unresolved product id: CSAFPID-32001 —
Unresolved product id: CSAFPID-32002 —
Unresolved product id: CSAFPID-32003 —
Unresolved product id: CSAFPID-32004 —
Unresolved product id: CSAFPID-32005 —
Unresolved product id: CSAFPID-32006 —
Unresolved product id: CSAFPID-32007 —
Unresolved product id: CSAFPID-32008 —
Unresolved product id: CSAFPID-32009 —
Unresolved product id: CSAFPID-32010 —
Unresolved product id: CSAFPID-32011 —
Unresolved product id: CSAFPID-32012 —
Unresolved product id: CSAFPID-32013 —
Unresolved product id: CSAFPID-32014 —
Unresolved product id: CSAFPID-32015 —
References
Acknowledgments
CERTVDE certvde.com
ABB Schweiz AG new.abb.com
To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERTVDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      },
      {
        "organization": "ABB Schweiz AG",
        "summary": "reporting",
        "urls": [
          "https://new.abb.com"
        ]
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "The CODESYS OPC UA stack of the CODESYS Control runtime system may incorrectly calculate the required buffer size for received requests/responses. This can lead to a crash of the CODESYS runtime system during the subsequent initialization of the receive buffer with zero.\n\nUpdate: 10.07.2024 In the Remediation section, the release date of the update has been deleted as the update is now available.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "The CODESYS OPC UA stack, implemented by the CmpOPCUAStack component, is an optional part of the CODESYS runtime system. Both the CODESYS OPC UA Server and the CODESYS OPC UA Client of the CODESYS Control runtime system use the CODESYS OPC UA Stack as a common implementation. The OPC UA protocol enables data exchange between the CODESYS runtime system and OPC UA clients such as SCADA or HMIs, or OPC UA servers such as PLCs or other devices.\n\nIf a CODESYS runtime system containing the CmpOPCUAStack component receives a specially crafted request/response, the required buffer size in the CODESYS OPC UA server/client may be incorrectly calculated. This can lead to a crash of the CODESYS runtime system during the subsequent initialization of the receive buffer with zero.\n\nAn attacker can exploit this vulnerability by using a malicious OPC UA client to send a crafted request to CODESYS products with an affected CODESYS OPC UA server. Conversely, CODESYS products with an affected CODESYS OPC UA client can be crashed if they have connected to a malicious OPC UA server. CODESYS Control runtime systems usually contain both the OPC UA client and the server. The CODESYS HMI only includes the OPC UA client.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Starting from version 3.5.15.0 of the affected products, the incorrect calculation of the buffer size can be avoided if the maximum supported array length of the OPC UA stack of the CODESYS Control runtime system is limited to a value of 10129639 or less.\n\nThis can be achieved by adding the following setting in the CODESYS runtime configuration file (e.g. CODESYSControl.cfg):\n[CmpOPCUAStack]\nStack.MaxArrayLenth=10129639",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "Update the following products to version 3.5.20.10:\n\n\n\u2022 CODESYS Control RTE (SL) \n\n\n \u2022 CODESYS Control RTE (for Beckhoff CX) SL \n\n\n \u2022 CODESYS Control Win (SL)\n\n\n\u2022 CODESYS Runtime Toolkit\n\n\n\u2022 CODESYS HMI (SL)\n\n\n\nUpdate the following products to version 4.12.0.0:\n\n\n\u2022 CODESYS Control for BeagleBone SL\n\n\n\u2022 CODESYS Control for emPC-A/iMX6 SL\n\n\n\u2022 CODESYS Control for IOT2000 SL\n\n\n\u2022 CODESYS Control for Linux ARM SL\n\n\n\u2022 CODESYS Control for Linux SL\n\n\n\u2022 CODESYS Control for PFC100 SL\n\n\n\u2022 CODESYS Control for PFC200 SL\n\n\n\u2022 CODESYS Control for PLCnext SL\n\n\n\u2022 CODESYS Control for Raspberry Pi SL\n\n\n\u2022 CODESYS Control for WAGO Touch Panels 600 SL\n\n\n\nThe products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS download area.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@codesys.com",
      "name": "CODESYS GmbH",
      "namespace": "https://www.codesys.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2024-026: CODESYS: Vulnerability can cause a DoS on CODESYS OPC UA products - HTML",
        "url": "https://certvde.com/de/advisories/VDE-2024-026/"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for CODESYS GmbH",
        "url": "https://certvde.com/en/advisories/vendor/codesys/"
      },
      {
        "category": "self",
        "summary": "VDE-2024-026: CODESYS: Vulnerability can cause a DoS on CODESYS OPC UA products - CSAF",
        "url": "https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2024/vde-2024-026.json"
      }
    ],
    "title": "CODESYS: Vulnerability can cause a DoS on CODESYS OPC UA products",
    "tracking": {
      "aliases": [
        "VDE-2024-026"
      ],
      "current_release_date": "2025-05-14T13:00:14.000Z",
      "generator": {
        "date": "2025-04-10T15:17:44.107Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.23"
        }
      },
      "id": "VDE-2024-026",
      "initial_release_date": "2024-06-04T08:00:00.000Z",
      "revision_history": [
        {
          "date": "2024-06-04T08:00:00.000Z",
          "number": "1",
          "summary": "initial revision"
        },
        {
          "date": "2025-05-14T13:00:14.000Z",
          "number": "2",
          "summary": "Fix: added distribution"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CODESYS Control for BeagleBone SL",
                "product": {
                  "name": "CODESYS Control for BeagleBone SL",
                  "product_id": "CSAFPID-11001"
                }
              },
              {
                "category": "product_name",
                "name": "CODESYS Control for emPC-A/iMX6 SL",
                "product": {
                  "name": "CODESYS Control for emPC-A/iMX6 SL",
                  "product_id": "CSAFPID-11002"
                }
              },
              {
                "category": "product_name",
                "name": "CODESYS Control for IOT2000 SL",
                "product": {
                  "name": "CODESYS Control for IOT2000 SL",
                  "product_id": "CSAFPID-11003"
                }
              },
              {
                "category": "product_name",
                "name": "CODESYS Control for Linux ARM SL",
                "product": {
                  "name": "CODESYS Control for Linux ARM SL",
                  "product_id": "CSAFPID-11004"
                }
              },
              {
                "category": "product_name",
                "name": "CODESYS Control for Linux SL",
                "product": {
                  "name": "CODESYS Control for Linux SL",
                  "product_id": "CSAFPID-11005"
                }
              },
              {
                "category": "product_name",
                "name": "CODESYS Control for PFC100 SL",
                "product": {
                  "name": "CODESYS Control for PFC100 SL",
                  "product_id": "CSAFPID-11006"
                }
              },
              {
                "category": "product_name",
                "name": "CODESYS Control for PFC200 SL",
                "product": {
                  "name": "CODESYS Control for PFC200 SL",
                  "product_id": "CSAFPID-11007"
                }
              },
              {
                "category": "product_name",
                "name": "CODESYS Control for PLCnext SL",
                "product": {
                  "name": "CODESYS Control for PLCnext SL",
                  "product_id": "CSAFPID-11008"
                }
              },
              {
                "category": "product_name",
                "name": "CODESYS Control for Raspberry Pi SL",
                "product": {
                  "name": "CODESYS Control for Raspberry Pi SL",
                  "product_id": "CSAFPID-11009"
                }
              },
              {
                "category": "product_name",
                "name": "CODESYS Control for WAGO Touch Panels 600 SL",
                "product": {
                  "name": "CODESYS Control for WAGO Touch Panels 600 SL",
                  "product_id": "CSAFPID-11010"
                }
              },
              {
                "category": "product_name",
                "name": "CODESYS Runtime Toolkit",
                "product": {
                  "name": "CODESYS Runtime Toolkit",
                  "product_id": "CSAFPID-12015"
                }
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c4.12.0.0",
                "product": {
                  "name": "Firmware \u003c4.12.0.0",
                  "product_id": "CSAFPID-21001"
                }
              },
              {
                "category": "product_version",
                "name": "4.12.0.0",
                "product": {
                  "name": "Firmware 4.12.0.0",
                  "product_id": "CSAFPID-22001"
                }
              },
              {
                "category": "product_version",
                "name": "3.5.20.10",
                "product": {
                  "name": "Firmware 3.5.20.10",
                  "product_id": "CSAFPID-22015"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c3.5.20.10",
                "product": {
                  "name": "Firmware \u003c3.5.20.10",
                  "product_id": "CSAFPID-21015"
                }
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "CODESYS GmbH"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CODESYS Control RTESL",
                "product": {
                  "name": "CODESYS Control RTESL",
                  "product_id": "CSAFPID-11011"
                }
              },
              {
                "category": "product_name",
                "name": "CODESYS Control RTE",
                "product": {
                  "name": "CODESYS Control RTE",
                  "product_id": "CSAFPID-11012"
                }
              },
              {
                "category": "product_name",
                "name": "CODESYS Control Win",
                "product": {
                  "name": "CODESYS Control Win",
                  "product_id": "CSAFPID-11013"
                }
              },
              {
                "category": "product_name",
                "name": "CODESYS HMI",
                "product": {
                  "name": "CODESYS HMI",
                  "product_id": "CSAFPID-11014"
                }
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.5.20.10",
                "product": {
                  "name": "Firmware \u003c3.5.20.10",
                  "product_id": "CSAFPID-21011"
                }
              },
              {
                "category": "product_version",
                "name": "3.5.20.10",
                "product": {
                  "name": "Firmware 3.5.20.10",
                  "product_id": "CSAFPID-22011"
                }
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "generic_vendor"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015"
        ],
        "summary": "affected products"
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014",
          "CSAFPID-32015"
        ],
        "summary": "fixed products"
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c4.12.0.0 installed on CODESYS Control for BeagleBone SL",
          "product_id": "CSAFPID-31001"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 4.12.0.0 installed on CODESYS Control for BeagleBone SL",
          "product_id": "CSAFPID-32001"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c4.12.0.0 installed on CODESYS Control for emPC-A/iMX6 SL",
          "product_id": "CSAFPID-31002"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 4.12.0.0 installed on CODESYS Control for emPC-A/iMX6 SL",
          "product_id": "CSAFPID-32002"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c4.12.0.0 installed on CODESYS Control for IOT2000 SL",
          "product_id": "CSAFPID-31003"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 4.12.0.0 installed on CODESYS Control for IOT2000 SL",
          "product_id": "CSAFPID-32003"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c4.12.0.0 installed on CODESYS Control for Linux ARM SL",
          "product_id": "CSAFPID-31004"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 4.12.0.0 installed on CODESYS Control for Linux ARM SL",
          "product_id": "CSAFPID-32004"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c4.12.0.0 installed on CODESYS Control for Linux SL",
          "product_id": "CSAFPID-31005"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 4.12.0.0 installed on CODESYS Control for Linux SL",
          "product_id": "CSAFPID-32005"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c4.12.0.0 installed on CODESYS Control for PFC100 SL",
          "product_id": "CSAFPID-31006"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 4.12.0.0 installed on CODESYS Control for PFC100 SL",
          "product_id": "CSAFPID-32006"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c4.12.0.0 installed on CODESYS Control for PFC200 SL",
          "product_id": "CSAFPID-31007"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 4.12.0.0 installed on CODESYS Control for PFC200 SL",
          "product_id": "CSAFPID-32007"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c4.12.0.0 installed on CODESYS Control for PLCnext SL",
          "product_id": "CSAFPID-31008"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 4.12.0.0 installed on CODESYS Control for PLCnext SL",
          "product_id": "CSAFPID-32008"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c4.12.0.0 installed on CODESYS Control for Raspberry Pi SL",
          "product_id": "CSAFPID-31009"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 4.12.0.0 installed on CODESYS Control for Raspberry Pi SL",
          "product_id": "CSAFPID-32009"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c4.12.0.0 installed on CODESYS Control for WAGO Touch Panels 600 SL",
          "product_id": "CSAFPID-31010"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 4.12.0.0 installed on CODESYS Control for WAGO Touch Panels 600 SL",
          "product_id": "CSAFPID-32010"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c3.5.20.10 installed on CODESYS Control RTESL",
          "product_id": "CSAFPID-31011"
        },
        "product_reference": "CSAFPID-21011",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 3.5.20.10 installed on CODESYS Control RTESL",
          "product_id": "CSAFPID-32011"
        },
        "product_reference": "CSAFPID-22011",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c3.5.20.10 installed on CODESYS Control RTE",
          "product_id": "CSAFPID-31012"
        },
        "product_reference": "CSAFPID-21011",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 3.5.20.10 installed on CODESYS Control RTE",
          "product_id": "CSAFPID-32012"
        },
        "product_reference": "CSAFPID-22011",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c3.5.20.10 installed on CODESYS Control Win",
          "product_id": "CSAFPID-31013"
        },
        "product_reference": "CSAFPID-21011",
        "relates_to_product_reference": "CSAFPID-11013"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 3.5.20.10 installed on CODESYS Control Win",
          "product_id": "CSAFPID-32013"
        },
        "product_reference": "CSAFPID-22011",
        "relates_to_product_reference": "CSAFPID-11013"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c3.5.20.10 installed on CODESYS HMI",
          "product_id": "CSAFPID-31014"
        },
        "product_reference": "CSAFPID-21011",
        "relates_to_product_reference": "CSAFPID-11014"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 3.5.20.10 installed on CODESYS HMI",
          "product_id": "CSAFPID-32014"
        },
        "product_reference": "CSAFPID-22011",
        "relates_to_product_reference": "CSAFPID-11014"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 3.5.20.10 installed on CODESYS Runtime Toolkit",
          "product_id": "CSAFPID-32015"
        },
        "product_reference": "CSAFPID-22015",
        "relates_to_product_reference": "CSAFPID-12015"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c3.5.20.10 installed on CODESYS Runtime Toolkit",
          "product_id": "CSAFPID-31015"
        },
        "product_reference": "CSAFPID-21015",
        "relates_to_product_reference": "CSAFPID-12015"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-5000",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014",
          "CSAFPID-32015"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Starting from version 3.5.15.0 of the affected products, the incorrect calculation of the buffer size can be avoided if the maximum supported array length of the OPC UA stack of the CODESYS Control runtime system is limited to a value of 10129639 or less.\n\nThis can be achieved by adding the following setting in the CODESYS runtime configuration file (e.g. CODESYSControl.cfg):\n[CmpOPCUAStack]\nStack.MaxArrayLenth=10129639",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update the following products to version 3.5.20.10:\n\n\n\u2022 CODESYS Control RTE (SL) \n\n\n \u2022 CODESYS Control RTE (for Beckhoff CX) SL \n\n\n \u2022 CODESYS Control Win (SL)\n\n\n\u2022 CODESYS Runtime Toolkit\n\n\n\u2022 CODESYS HMI (SL)\n\n\n\nUpdate the following products to version 4.12.0.0:\n\n\n\u2022 CODESYS Control for BeagleBone SL\n\n\n\u2022 CODESYS Control for emPC-A/iMX6 SL\n\n\n\u2022 CODESYS Control for IOT2000 SL\n\n\n\u2022 CODESYS Control for Linux ARM SL\n\n\n\u2022 CODESYS Control for Linux SL\n\n\n\u2022 CODESYS Control for PFC100 SL\n\n\n\u2022 CODESYS Control for PFC200 SL\n\n\n\u2022 CODESYS Control for PLCnext SL\n\n\n\u2022 CODESYS Control for Raspberry Pi SL\n\n\n\u2022 CODESYS Control for WAGO Touch Panels 600 SL\n\n\n\nThe products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS download area.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015"
          ]
        }
      ],
      "title": "CVE-2024-5000"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.