Article No° | Product Name | Affected Version(s) |
---|---|---|
CODESYS Control for BeagleBone SL | < 4.17.0.0 | |
CODESYS Control for emPC-A/iMX6 SL | < 4.17.0.0 | |
CODESYS Control for IOT2000 SL | < 4.17.0.0 | |
CODESYS Control for Linux ARM SL | < 4.17.0.0 | |
CODESYS Control for Linux SL | < 4.17.0.0 | |
CODESYS Control for PFC100 SL | < 4.17.0.0 | |
CODESYS Control for PFC200 SL | < 4.17.0.0 | |
CODESYS Control for PLCnext SL | < 4.17.0.0 | |
CODESYS Control for Raspberry Pi SL | < 4.17.0.0 | |
CODESYS Control for WAGO Touch Panels 600 SL | < 4.17.0.0 | |
CODESYS Control RTE (for Beckhoff CX) SL | < 3.5.21.20 | |
CODESYS Control RTE (SL) | < 3.5.21.20 | |
CODESYS Control Win (SL) | < 3.5.21.20 | |
CODESYS HMI (SL) | < 3.5.21.20 | |
CODESYS Runtime Toolkit | < 3.5.21.20 | |
CODESYS Virtual Control SL | < 4.17.0.0 |
A vulnerability in the CODESYS Control runtime system allows low-privileged remote attackers to access the PKI folder via CODESYS protocol, enabling them to read and write certificates and keys. This exposes sensitive cryptographic data and allows unauthorized certificates to be trusted. However, all services remain available, only certificate based encryption and signing features are concerned. The issue affects systems using the optional CmpOpenSSL component for cryptographic operations.
A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.
Unauthorized access to PKI files allows attackers to extract sensitive cryptographic keys and manipulate trusted certificates. This compromises system integrity, confidentiality and partially affects availability.
General Recommendation
As part of a security strategy, CODESYS GmbH strongly recommends at least the following best-practice defense measures:
For more information and general recommendations for protecting machines and plants, see also the CODESYS Security Whitepaper here.
Remediation
Update the following products to version 3.5.21.20.
Update the following products to version 4.17.0.0. The release of this version is expected for August 2025.
The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
Following our general recommendation that the PKI should only be managed via the dedicated X.509 API or the corresponding online services of the CODESYS Control runtime system, the programmatic direct access via SysFile or SysDir operations or online access via the CODESYS file transfer services is denied after an update to a fixed product version. For compatibility reasons, the old behavior can be restored for applications that use these accesses via the following setting: [CmpOpenSSL] EnforceBlacklistOnPKIDir=0
However, CODESYS GmbH strongly recommends keeping the new default.
CERT@VDE coordinated with CODESYS GmbH.
Luca Borzacchiello from Nozomi Networks for reporting.