CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.
References
| Link | Resource |
|---|---|
| https://customers.codesys.com/index.php | Permissions Required Vendor Advisory |
| https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14640&token=623b6fceb0579ef0f7505e29beefa5b3f8ac7873&download= | Vendor Advisory |
| https://www.codesys.com/security/security-reports.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
14 Sep 2021, 18:18
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:codesys:control_runtime_system_toolkit:*:*:*:*:*:*:*:* |
13 May 2021, 20:23
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://customers.codesys.com/index.php - Permissions Required, Vendor Advisory | |
| References | (MISC) https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14640&token=623b6fceb0579ef0f7505e29beefa5b3f8ac7873&download= - Vendor Advisory | |
| References | (MISC) https://www.codesys.com/security/security-reports.html - Vendor Advisory | |
| CPE | cpe:2.3:a:codesys:hmi:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:conrol_runtime_system_toolkit:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:embedded_target_visu_toolkit:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:simulation_runtime:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:edge_gateway:*:*:*:*:*:linux:*:* cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_rte:*:*:*:*:*:beckhoff_cx:*:* cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:safety_sil:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_win:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:opc_server:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_rte:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:edge_gateway:*:*:*:*:*:windows:*:* cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_for_linux_arm_sl:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:plchandler:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:gateway:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:remote_target_visu_toolkit:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 7.3 |
| CWE | CWE-20 |
03 May 2021, 14:58
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-05-03 14:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-29242
Mitre link : CVE-2021-29242
CVE.ORG link : CVE-2021-29242
JSON object : View
Products Affected
codesys
- control_for_wago_touch_panels_600_sl
- gateway
- control_for_pfc200_sl
- control_for_plcnext_sl
- control_for_raspberry_pi_sl
- edge_gateway
- opc_server
- remote_target_visu_toolkit
- control_for_beaglebone_sl
- control_for_pfc100_sl
- control_for_linux_arm_sl
- control_win
- embedded_target_visu_toolkit
- safety_sil
- plchandler
- control_rte
- hmi
- control_for_linux_sl
- control_for_empc-a\/imx6_sl
- simulation_runtime
- control_for_iot2000_sl
- control_runtime_system_toolkit
CWE
CWE-20
Improper Input Validation