Summary
Multiple vulnerabilities were reported in CODESYS 2.3 Runtime. The CODESYS 2.3 Runtime is an essential component in several WAGO PLC's.
Impact
The reported vulnerabilities allow an attacker who has access to the device and is able to exploit the vulnerabilities, to manipulate and disrupt the CODESYS 2.3 Runtime.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| 750-8202/xxx-xxx | Firmware <03.06.19 (18) | |
| 750-8203/xxx-xxx | Firmware <03.06.19 (18) | |
| 750-8204/xxx-xxx | Firmware <03.06.19 (18) | |
| 750-8206/xxx-xxx | Firmware <03.06.19 (18) | |
| 750-8207/xxx-xxx | Firmware <03.06.19 (18) | |
| 750-8208/xxx-xxx | Firmware <03.06.19 (18) | |
| 750-8210/xxx-xxx | Firmware <03.06.19 (18) | |
| 750-8211/xxx-xxx | Firmware <03.06.19 (18) | |
| 750-8212/xxx-xxx | Firmware <03.06.19 (18) | |
| 750-8213/xxx-xxx | Firmware <03.06.19 (18) | |
| 750-8214/xxx-xxx | Firmware <03.06.19 (18) | |
| 750-8216/xxx-xxx | Firmware <03.06.19 (18) | |
| 750-8217/xxx-xxx | Firmware <03.06.19 (18) | |
| 750-823 | Firmware <=FW07 | |
| 750-829 | Firmware <=FW14 | |
| 750-831/000-00x | Firmware <=FW14 | |
| 750-832/000-00x | Firmware <=FW06 | |
| 750-852 | Firmware <=FW14 | |
| 750-862 | Firmware <=FW07 | |
| 750-880/0xx-xxx | Firmware <=FW15 | |
| 750-881 | Firmware <=FW14 | |
| 750-882 | Firmware <=FW14 | |
| 750-885/0xx-xxx | Firmware <=FW14 | |
| 750-889 | Firmware <=FW14 | |
| 750-890/0xx-xxx | Firmware <=FW07 | |
| 750-891 | Firmware <=FW07 | |
| 750-893 | Firmware <=FW07 |
Vulnerabilities
Expand / Collapse allCODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.
CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow.
CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.
CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write.
CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read.
On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of service for the login service of the runtime.
CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input.
CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.
CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.
CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.
Mitigation
- Use general security best practices to protect systems from local and network attacks.
- Do not allow direct access to the device from untrusted networks.
- Update to the latest firmware according to the table in chapter solutions.
- Disable the CODESYS 2.3 Web-Visualisation and CODESYS 2.3 port 2455.
For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at www.codesys.com/security/security-rep... external link
Remediation
WAGO recommends all effected users with CODESYS 2.3 Runtime PLCs to update to the firmware version listed below.
Series Ethernet Controller:
| Article No. | Fixed Version | Available |
|---|---|---|
| 750-823 | >=FW08 | June 2021 |
| 750-829 | >=FW15 | May 2021 |
| 750-831/000-00x | >=FW15 | May 2021 |
| 750-832/000-00x | >=FW08 | June 2021 |
| 750-852 | >=FW15 | May 2021 |
| 750-862 | >=FW08 | June 2021 |
| 750-880/0xx-xxx | >=FW16 | May 2021 |
| 750-881 | >=FW15 | May 2021 |
| 750-882 | >=FW15 | May 2021 |
| 750-885/0xx-xxx | >=FW15 | May 2021 |
| 750-889 | >=FW15 | May 2021 |
| 750-890/0xx-xxx | >=FW08 | June 2021 |
| 750-891 | >=FW08 | June 2021 |
| 750-893 | >=FW08 | June 2021 |
Series PFC200 Controller
| Article No. | Fixed Patch | Patch Available | Fixed Firmware | Firmware Approx. Available |
|---|---|---|---|---|
| 750-8202/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8203/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8204/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8206/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8207/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8208/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8210/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8211/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8212/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8213/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8214/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8216/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8217/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
Revision History
| Version | Date | Summary |
|---|---|---|
| 1 | 15.05.2021 11:00 | Initial revision. |
| 2 | 22.05.2025 15:03 | Fix: version space, added distribution, quotation mark |