| Article No° | Product Name | Affected Version(s) |
|---|---|---|
| CODESYS Control for BeagleBone SL | < 4.15.0.0 | |
| CODESYS Control for emPC-A/iMX6 SL | < 4.15.0.0 | |
| CODESYS Control for IOT2000 SL | < 4.15.0.0 | |
| CODESYS Control for Linux ARM SL | < 4.15.0.0 | |
| CODESYS Control for Linux SL | < 4.15.0.0 | |
| CODESYS Control for PFC100 SL | < 4.15.0.0 | |
| CODESYS Control for PFC200 SL | < 4.15.0.0 | |
| CODESYS Control for PLCnext SL | < 4.15.0.0 | |
| CODESYS Control for Raspberry Pi SL | < 4.15.0.0 | |
| CODESYS Control for WAGO Touch Panels 600 SL | < 4.15.0.0 | |
| CODESYS Control RTE (for Beckhoff CX) SL | < 3.5.21.0 | |
| CODESYS Control RTE (SL) | < 3.5.21.0 | |
| CODESYS Control Win (SL) | < 3.5.21.0 | |
| CODESYS Embedded Target Visu Toolkit | < 3.5.21.0 | |
| CODESYS HMI (SL) | < 3.5.21.0 | |
| CODESYS Remote Target Visu Toolkit | < 3.5.21.0 | |
| CODESYS Runtime Toolkit | < 3.5.21.0 | |
| CODESYS Virtual Control SL | < 4.15.0.0 | |
| CODESYS Visualization | < 4.8.0.0 |
An unauthenticated attacker can read static visualization files of the CODESYS WebVisu, by bypassing the CODESYS Visualization user management applying forced browsing.
An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing.
The CODESYS Visualization, together with the CmpWebServer component in the CODESYS Control Runtime, allows users to create browser-based visualizations for monitoring and controlling industrial processes. Access to these visualizations can be restricted using the built-in user management.
However, on CODESYS Control Runtime systems, where an application with a CODESYS WebVisu is executed, an unauthenticated remote attacker can bypass the user management and read visualization files by means of forced browsing. The exposed files, accessible via a web browser, contain only static visualization data such as text lists, icons or images, but no live data from the controlled system.
Remediation
Update the following product to version 4.8.0.0.
Update the following products to version 3.5.21.0.
Update the following products to version 4.15.0.0.
Updates of both the CODESYS Visualization and the CODESYS Control Runtime System or the CODESYS HMI are required to fix the vulnerability.
Moreover, existing CODESYS projects that include a CODESYS WebVisu must be recompiled and downloaded to the updated HMI or PLC.
The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
CERT@VDE coordinated with CODESYS GmbH
Reporting: M. Ankith by Honeywell