{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "tracking": { "generator": { "date": "2025-04-10T15:17:44.107Z", "engine": { "version": "2.5.23", "name": "Secvisogram" } }, "id": "VDE-2024-026", "version": "2", "status": "final", "aliases": [ "VDE-2024-026" ], "revision_history": [ { "number": "1", "summary": "initial revision", "date": "2024-06-04T08:00:00.000Z" }, { "number": "2", "summary": "Fix: added distribution", "date": "2025-05-14T13:00:14.000Z" } ], "current_release_date": "2025-05-14T13:00:14.000Z", "initial_release_date": "2024-06-04T08:00:00.000Z" }, "lang": "en-GB", "title": "CODESYS: Vulnerability can cause a DoS on CODESYS OPC UA products", "acknowledgments": [ { "organization": "CERTVDE", "urls": [ "https://certvde.com" ], "summary": "coordination" }, { "organization": "ABB Schweiz AG", "summary": "reporting", "urls": [ "https://new.abb.com" ] } ], "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "notes": [ { "category": "summary", "title": "Summary", "text": "The CODESYS OPC UA stack of the CODESYS Control runtime system may incorrectly calculate the required buffer size for received requests/responses. This can lead to a crash of the CODESYS runtime system during the subsequent initialization of the receive buffer with zero.\n\nUpdate: 10.07.2024 In the Remediation section, the release date of the update has been deleted as the update is now available." }, { "category": "description", "title": "Impact", "text": "The CODESYS OPC UA stack, implemented by the CmpOPCUAStack component, is an optional part of the CODESYS runtime system. Both the CODESYS OPC UA Server and the CODESYS OPC UA Client of the CODESYS Control runtime system use the CODESYS OPC UA Stack as a common implementation. The OPC UA protocol enables data exchange between the CODESYS runtime system and OPC UA clients such as SCADA or HMIs, or OPC UA servers such as PLCs or other devices.\n\nIf a CODESYS runtime system containing the CmpOPCUAStack component receives a specially crafted request/response, the required buffer size in the CODESYS OPC UA server/client may be incorrectly calculated. This can lead to a crash of the CODESYS runtime system during the subsequent initialization of the receive buffer with zero.\n\nAn attacker can exploit this vulnerability by using a malicious OPC UA client to send a crafted request to CODESYS products with an affected CODESYS OPC UA server. Conversely, CODESYS products with an affected CODESYS OPC UA client can be crashed if they have connected to a malicious OPC UA server. CODESYS Control runtime systems usually contain both the OPC UA client and the server. The CODESYS HMI only includes the OPC UA client." }, { "category": "description", "title": "Mitigation", "text": "Starting from version 3.5.15.0 of the affected products, the incorrect calculation of the buffer size can be avoided if the maximum supported array length of the OPC UA stack of the CODESYS Control runtime system is limited to a value of 10129639 or less.\n\nThis can be achieved by adding the following setting in the CODESYS runtime configuration file (e.g. CODESYSControl.cfg):\n[CmpOPCUAStack]\nStack.MaxArrayLenth=10129639" }, { "category": "description", "title": "Remediation", "text": "Update the following products to version 3.5.20.10:\n\n\n• CODESYS Control RTE (SL) \n\n\n • CODESYS Control RTE (for Beckhoff CX) SL \n\n\n • CODESYS Control Win (SL)\n\n\n• CODESYS Runtime Toolkit\n\n\n• CODESYS HMI (SL)\n\n\n\nUpdate the following products to version 4.12.0.0:\n\n\n• CODESYS Control for BeagleBone SL\n\n\n• CODESYS Control for emPC-A/iMX6 SL\n\n\n• CODESYS Control for IOT2000 SL\n\n\n• CODESYS Control for Linux ARM SL\n\n\n• CODESYS Control for Linux SL\n\n\n• CODESYS Control for PFC100 SL\n\n\n• CODESYS Control for PFC200 SL\n\n\n• CODESYS Control for PLCnext SL\n\n\n• CODESYS Control for Raspberry Pi SL\n\n\n• CODESYS Control for WAGO Touch Panels 600 SL\n\n\n\nThe products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS download area." } ], "publisher": { "category": "vendor", "contact_details": "security@codesys.com", "name": "CODESYS GmbH", "namespace": "https://www.codesys.com" }, "references": [ { "summary": "VDE-2024-026: CODESYS: Vulnerability can cause a DoS on CODESYS OPC UA products - HTML", "url": "https://certvde.com/de/advisories/VDE-2024-026/", "category": "self" }, { "category": "external", "summary": "CERT@VDE Security Advisories for CODESYS GmbH", "url": "https://certvde.com/en/advisories/vendor/codesys/" }, { "summary": "VDE-2024-026: CODESYS: Vulnerability can cause a DoS on CODESYS OPC UA products - CSAF", "url": "https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2024/vde-2024-026.json", "category": "self" } ] }, "product_tree": { "branches": [ { "category": "vendor", "name": "CODESYS GmbH", "branches": [ { "category": "product_family", "name": "Hardware", "branches": [ { "category": "product_name", "name": "CODESYS Control for BeagleBone SL", "product": { "name": "CODESYS Control for BeagleBone SL", "product_id": "CSAFPID-11001" } }, { "category": "product_name", "name": "CODESYS Control for emPC-A/iMX6 SL", "product": { "name": "CODESYS Control for emPC-A/iMX6 SL", "product_id": "CSAFPID-11002" } }, { "category": "product_name", "name": "CODESYS Control for IOT2000 SL", "product": { "name": "CODESYS Control for IOT2000 SL", "product_id": "CSAFPID-11003" } }, { "category": "product_name", "name": "CODESYS Control for Linux ARM SL", "product": { "name": "CODESYS Control for Linux ARM SL", "product_id": "CSAFPID-11004" } }, { "category": "product_name", "name": "CODESYS Control for Linux SL", "product": { "name": "CODESYS Control for Linux SL", "product_id": "CSAFPID-11005" } }, { "category": "product_name", "name": "CODESYS Control for PFC100 SL", "product": { "name": "CODESYS Control for PFC100 SL", "product_id": "CSAFPID-11006" } }, { "category": "product_name", "name": "CODESYS Control for PFC200 SL", "product": { "name": "CODESYS Control for PFC200 SL", "product_id": "CSAFPID-11007" } }, { "category": "product_name", "name": "CODESYS Control for PLCnext SL", "product": { "name": "CODESYS Control for PLCnext SL", "product_id": "CSAFPID-11008" } }, { "category": "product_name", "name": "CODESYS Control for Raspberry Pi SL", "product": { "name": "CODESYS Control for Raspberry Pi SL", "product_id": "CSAFPID-11009" } }, { "category": "product_name", "name": "CODESYS Control for WAGO Touch Panels 600 SL", "product": { "name": "CODESYS Control for WAGO Touch Panels 600 SL", "product_id": "CSAFPID-11010" } }, { "category": "product_name", "name": "CODESYS Runtime Toolkit", "product": { "name": "CODESYS Runtime Toolkit", "product_id": "CSAFPID-12015" } } ] }, { "category": "product_family", "name": "Firmware", "branches": [ { "category": "product_version_range", "name": "<4.12.0.0", "product": { "name": "Firmware <4.12.0.0", "product_id": "CSAFPID-21001" } }, { "category": "product_version", "name": "4.12.0.0", "product": { "name": "Firmware 4.12.0.0", "product_id": "CSAFPID-22001" } }, { "category": "product_version", "name": "3.5.20.10", "product": { "name": "Firmware 3.5.20.10", "product_id": "CSAFPID-22015" } }, { "category": "product_version_range", "name": "<3.5.20.10", "product": { "name": "Firmware <3.5.20.10", "product_id": "CSAFPID-21015" } } ] } ] }, { "category": "vendor", "name": "generic_vendor", "branches": [ { "category": "product_family", "name": "Hardware", "branches": [ { "category": "product_name", "name": "CODESYS Control RTESL", "product": { "name": "CODESYS Control RTESL", "product_id": "CSAFPID-11011" } }, { "category": "product_name", "name": "CODESYS Control RTE", "product": { "name": "CODESYS Control RTE", "product_id": "CSAFPID-11012" } }, { "category": "product_name", "name": "CODESYS Control Win", "product": { "name": "CODESYS Control Win", "product_id": "CSAFPID-11013" } }, { "category": "product_name", "name": "CODESYS HMI", "product": { "name": "CODESYS HMI", "product_id": "CSAFPID-11014" } } ] }, { "category": "product_family", "name": "Firmware", "branches": [ { "category": "product_version_range", "name": "<3.5.20.10", "product": { "name": "Firmware <3.5.20.10", "product_id": "CSAFPID-21011" } }, { "category": "product_version", "name": "3.5.20.10", "product": { "name": "Firmware 3.5.20.10", "product_id": "CSAFPID-22011" } } ] } ] } ], "relationships": [ { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "full_product_name": { "name": "Firmware <4.12.0.0 installed on CODESYS Control for BeagleBone SL", "product_id": "CSAFPID-31001" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001", "full_product_name": { "name": "Firmware 4.12.0.0 installed on CODESYS Control for BeagleBone SL", "product_id": "CSAFPID-32001" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002", "full_product_name": { "name": "Firmware <4.12.0.0 installed on CODESYS Control for emPC-A/iMX6 SL", "product_id": "CSAFPID-31002" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11002", "full_product_name": { "name": "Firmware 4.12.0.0 installed on CODESYS Control for emPC-A/iMX6 SL", "product_id": "CSAFPID-32002" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003", "full_product_name": { "name": "Firmware <4.12.0.0 installed on CODESYS Control for IOT2000 SL", "product_id": "CSAFPID-31003" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11003", "full_product_name": { "name": "Firmware 4.12.0.0 installed on CODESYS Control for IOT2000 SL", "product_id": "CSAFPID-32003" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11004", "full_product_name": { "name": "Firmware <4.12.0.0 installed on CODESYS Control for Linux ARM SL", "product_id": "CSAFPID-31004" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11004", "full_product_name": { "name": "Firmware 4.12.0.0 installed on CODESYS Control for Linux ARM SL", "product_id": "CSAFPID-32004" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11005", "full_product_name": { "name": "Firmware <4.12.0.0 installed on CODESYS Control for Linux SL", "product_id": "CSAFPID-31005" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11005", "full_product_name": { "name": "Firmware 4.12.0.0 installed on CODESYS Control for Linux SL", "product_id": "CSAFPID-32005" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11006", "full_product_name": { "name": "Firmware <4.12.0.0 installed on CODESYS Control for PFC100 SL", "product_id": "CSAFPID-31006" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11006", "full_product_name": { "name": "Firmware 4.12.0.0 installed on CODESYS Control for PFC100 SL", "product_id": "CSAFPID-32006" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11007", "full_product_name": { "name": "Firmware <4.12.0.0 installed on CODESYS Control for PFC200 SL", "product_id": "CSAFPID-31007" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11007", "full_product_name": { "name": "Firmware 4.12.0.0 installed on CODESYS Control for PFC200 SL", "product_id": "CSAFPID-32007" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11008", "full_product_name": { "name": "Firmware <4.12.0.0 installed on CODESYS Control for PLCnext SL", "product_id": "CSAFPID-31008" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11008", "full_product_name": { "name": "Firmware 4.12.0.0 installed on CODESYS Control for PLCnext SL", "product_id": "CSAFPID-32008" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11009", "full_product_name": { "name": "Firmware <4.12.0.0 installed on CODESYS Control for Raspberry Pi SL", "product_id": "CSAFPID-31009" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11009", "full_product_name": { "name": "Firmware 4.12.0.0 installed on CODESYS Control for Raspberry Pi SL", "product_id": "CSAFPID-32009" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11010", "full_product_name": { "name": "Firmware <4.12.0.0 installed on CODESYS Control for WAGO Touch Panels 600 SL", "product_id": "CSAFPID-31010" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11010", "full_product_name": { "name": "Firmware 4.12.0.0 installed on CODESYS Control for WAGO Touch Panels 600 SL", "product_id": "CSAFPID-32010" } }, { "category": "installed_on", "product_reference": "CSAFPID-21011", "relates_to_product_reference": "CSAFPID-11011", "full_product_name": { "name": "Firmware <3.5.20.10 installed on CODESYS Control RTESL", "product_id": "CSAFPID-31011" } }, { "category": "installed_on", "product_reference": "CSAFPID-22011", "relates_to_product_reference": "CSAFPID-11011", "full_product_name": { "name": "Firmware 3.5.20.10 installed on CODESYS Control RTESL", "product_id": "CSAFPID-32011" } }, { "category": "installed_on", "product_reference": "CSAFPID-21011", "relates_to_product_reference": "CSAFPID-11012", "full_product_name": { "name": "Firmware <3.5.20.10 installed on CODESYS Control RTE", "product_id": "CSAFPID-31012" } }, { "category": "installed_on", "product_reference": "CSAFPID-22011", "relates_to_product_reference": "CSAFPID-11012", "full_product_name": { "name": "Firmware 3.5.20.10 installed on CODESYS Control RTE", "product_id": "CSAFPID-32012" } }, { "category": "installed_on", "product_reference": "CSAFPID-21011", "relates_to_product_reference": "CSAFPID-11013", "full_product_name": { "name": "Firmware <3.5.20.10 installed on CODESYS Control Win", "product_id": "CSAFPID-31013" } }, { "category": "installed_on", "product_reference": "CSAFPID-22011", "relates_to_product_reference": "CSAFPID-11013", "full_product_name": { "name": "Firmware 3.5.20.10 installed on CODESYS Control Win", "product_id": "CSAFPID-32013" } }, { "category": "installed_on", "product_reference": "CSAFPID-21011", "relates_to_product_reference": "CSAFPID-11014", "full_product_name": { "name": "Firmware <3.5.20.10 installed on CODESYS HMI", "product_id": "CSAFPID-31014" } }, { "category": "installed_on", "product_reference": "CSAFPID-22011", "relates_to_product_reference": "CSAFPID-11014", "full_product_name": { "name": "Firmware 3.5.20.10 installed on CODESYS HMI", "product_id": "CSAFPID-32014" } }, { "category": "installed_on", "product_reference": "CSAFPID-22015", "relates_to_product_reference": "CSAFPID-12015", "full_product_name": { "name": "Firmware 3.5.20.10 installed on CODESYS Runtime Toolkit", "product_id": "CSAFPID-32015" } }, { "category": "installed_on", "product_reference": "CSAFPID-21015", "relates_to_product_reference": "CSAFPID-12015", "full_product_name": { "name": "Firmware <3.5.20.10 installed on CODESYS Runtime Toolkit", "product_id": "CSAFPID-31015" } } ], "product_groups": [ { "group_id": "CSAFGID-0001", "summary": "affected products", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015" ] }, { "group_id": "CSAFGID-0002", "summary": "fixed products", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014", "CSAFPID-32015" ] } ] }, "vulnerabilities": [ { "cve": "CVE-2024-5000", "title": "CVE-2024-5000", "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015" ], "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014", "CSAFPID-32015" ] }, "scores": [ { "cvss_v3": { "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "temporalScore": 7.5, "temporalSeverity": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015" ] } ], "notes": [ { "category": "summary", "text": "An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size." } ], "remediations": [ { "category": "mitigation", "details": "Starting from version 3.5.15.0 of the affected products, the incorrect calculation of the buffer size can be avoided if the maximum supported array length of the OPC UA stack of the CODESYS Control runtime system is limited to a value of 10129639 or less.\n\nThis can be achieved by adding the following setting in the CODESYS runtime configuration file (e.g. CODESYSControl.cfg):\n[CmpOPCUAStack]\nStack.MaxArrayLenth=10129639", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Update the following products to version 3.5.20.10:\n\n\n• CODESYS Control RTE (SL) \n\n\n • CODESYS Control RTE (for Beckhoff CX) SL \n\n\n • CODESYS Control Win (SL)\n\n\n• CODESYS Runtime Toolkit\n\n\n• CODESYS HMI (SL)\n\n\n\nUpdate the following products to version 4.12.0.0:\n\n\n• CODESYS Control for BeagleBone SL\n\n\n• CODESYS Control for emPC-A/iMX6 SL\n\n\n• CODESYS Control for IOT2000 SL\n\n\n• CODESYS Control for Linux ARM SL\n\n\n• CODESYS Control for Linux SL\n\n\n• CODESYS Control for PFC100 SL\n\n\n• CODESYS Control for PFC200 SL\n\n\n• CODESYS Control for PLCnext SL\n\n\n• CODESYS Control for Raspberry Pi SL\n\n\n• CODESYS Control for WAGO Touch Panels 600 SL\n\n\n\nThe products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS download area.", "group_ids": [ "CSAFGID-0001" ] } ], "cwe": { "id": "CWE-131", "name": "Incorrect Calculation of Buffer Size" } } ] }