ICS-Advisories

Risk Evaluation

The monitoring functionality of affected CODESYS Control runtime systems processes read and write requests to PLC application data sent by the CODESYS Development System and other clients such as HMIs. Due to improper synchronization in the CmpMonitor2 component when processing concurrent requests from multiple clients, incorrect data may be read or written, potentially resulting in unexpected behavior of the affected product. PLCs based on the CODESYS Runtime Toolkit or CODESYS Safety SIL2 are affected if they allow simultaneous access by two or more clients via the CODESYS protocol. In CODESYS Development System 3, simultaneous access to the included Simulation Runtime can only occur when access by an external client, such as an HMI, has been explicitly enabled through dedicated configuration. The default configuration of CODESYS Development System 3 is not affected. The vulnerability can be exploited by an authenticated remote attacker with monitoring access by issuing concurrent requests to an affected product.

Zusammenfassung der Gegenmaßnahmen

Update the following products to version 3.5.22.40. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS Runtime Toolkit * CODESYS Safety SIL2 * CODESYS HMI (SL) * CODESYS Development System 3 The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

Risk Evaluation

The CODESYS Gateway Client (CmpGwClient) is used by various CODESYS products to establish PLC communication via the CODESYS Gateway. Due to missing limits on memory allocations derived from a size field in a gateway response, a malicious gateway can cause excessive memory consumption in the client, resulting in a denial-of-service condition. The vulnerability can be exploited when an affected product connects to an attacker-controlled gateway.

Zusammenfassung der Gegenmaßnahmen

Update the following products to version 3.5.22.40. * CODESYS Development System 3 * CODESYS Gateway * CODESYS Edge Gateway for Windows * CODESYS HMI (SL) * CODESYS OPC DA Server SL * CODESYS PLCHandler * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

Risk Evaluation

CODESYS PROFINET is an add‑on for the CODESYS Development System that provides a fully integrated PROFINET protocol stack along with diagnostic capabilities. When a PROFINET Controller is configured, this vulnerable protocol stack is downloaded to and executed by CODESYS Control runtime systems. The vulnerability in the CODESYS PROFINET Controller is caused by an out‑of‑bounds write during the processing of received invalid PROFINET communication data. Triggering this condition causes the CODESYS Control runtime system to handle the resulting exception and stop the affected PLC application in a controlled manner. Remote code execution is not considered feasible, as the execution flow remains controlled. This issue affects only CODESYS projects that include a PROFINET Controller configuration.

Zusammenfassung der Gegenmaßnahmen

Update the following product to version 4.8.0.0. * CODESYS PROFINET To make the fix effective for existing CODESYS projects, you must additionally update the PROFINET Controller in the device tree to the latest version and perform a download of the CODESYS application to the PLC. The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

Risk Evaluation

CODESYS EtherNet/IP is an add‑on for the CODESYS Development System that provides a fully integrated EtherNet/IP protocol stack along with diagnostic capabilities. A flaw in the EtherNet/IP adapter protocol stack library results in a vulnerability within the generated application code. When an EtherNet/IP adapter is configured, this vulnerable protocol stack is downloaded to and executed by CODESYS Control runtime systems. Under certain non‑standard operating conditions, the EtherNet/IP adapter fails to perform timeout checks on active TCP connections. As a result, once all available TCP connections are in use, expired connections are not released and no new TCP connections can be established. Existing connections remain unaffected and continue to operate normally. This issue affects only CODESYS projects that include an EtherNet/IP adapter configuration.

Zusammenfassung der Gegenmaßnahmen

Update the following products to version 4.9.0.0. * CODESYS EtherNetIP To make the fix effective for existing CODESYS projects, you must additionally update the EtherNet/IP adapter in the device tree to the latest version and perform a download of the CODESYS application to the PLC. The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

Risk Evaluation

The CODESYS Control runtime system provides a user management mechanism with multiple privilege groups. While only the privileged Administrators and Developer groups are intended to load or debug applications on the controller, users in the restricted Service group are allowed to perform maintenance operations, including explicitly replacing the boot application. In addition to access control, the CODESYS Control runtime system includes an optional application signing feature. When enabled, the controller executes only applications that have been validly signed by authorized developers. However, the CmpApp component of the CODESYS Control runtime systems allows Service‑group users to install a new boot application without requiring any cryptographic validation, if the application signing is not enforced. As a result, users with Service‑level privileges can install arbitrary boot applications and gain control over the code executed on the controller. Note: The user group "Service" is a predefined group within the CODESYS Control runtime system. If additional user groups have been created or if the permissions of predefined groups have been modified, then the term "Service" should be understood as a synonym for all groups and their users with no or only limited access rights to the "PlcLogic" object, in conjunction with "Add/Remove" or "Modify" permissions for the boot application files.

Zusammenfassung der Gegenmaßnahmen

Without applying the update, the vulnerability can be mitigated by enforcing the use of signed applications through the following setting: [CmpApp] SECURITY.EnforceSignedCode=YES This can be configured either via the Device Security Settings dialog in the CODESYS Development System or directly in the configuration file of the CODESYS Control runtime system (CODESYSControl.cfg). When this option is enabled, the CODESYS Control runtime system loads only trusted and valid signed applications. Alternatively, all users belonging to the Service group can be removed, or the Service group can be deleted entirely. If none of the other mitigation options are feasible, the permissions of the Service group can be restricted by adjusting their access rights. For example, removing modify permissions for the Service group on relevant file system objects can prevent the upload of untrusted boot applications. However, such changes must be applied with caution, as they may lead to inconsistent permissions for this user group and result in unexpected operational limitations. Therefore, this approach should only be considered after a careful assessment of the specific situation.

Risk Evaluation

The CODESYS Control runtime system provides a user management mechanism with multiple privilege groups including the visualization administrators group, which is intended solely to manage visualization users. Due to insufficient authorization checks an authenticated remote user with low-privileged visualization administrator access can delete higher-privileged accounts. However, independent mechanisms protect the deletion of the last remaining device admin user, preventing a complete loss of administrative access to the device. The CODESYS Control runtime system is only affected if the optional visualization user management feature is enabled and a visualization administrator account has been configured.

Zusammenfassung der Gegenmaßnahmen

Update the following products to version 3.5.22.20. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS HMI (SL) * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

Risk Evaluation

The CmpWebServer component in the CODESYS Control Runtime allows users to create browser-based visualizations for monitoring and controlling industrial processes. Due to improper bounds checking, a specially crafted HTTP request from an unauthenticated remote attacker may lead to a size-limited out-of-bounds write, causing a denial of service of the affected device. The CODESYS Control runtime system is only affected if the web server is active, which by default requires a running application with an enabled Web Visualization.

Zusammenfassung der Gegenmaßnahmen

Update the following products to version 3.5.22.20. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS HMI (SL) * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

Risk Evaluation

The CODESYS Control runtime system's CmpAuditLog component allows potentially unauthenticated remote attackers to control the format string of processed log messages. Due to the internal processing logic, the impact is limited to a crash of the CODESYS Control runtime.

Zusammenfassung der Gegenmaßnahmen

As a mitigation, the Audit Log feature can be disabled in the CODESYS Control runtime configuration file. When the Audit Log logger is not enabled, the affected functionality is no longer exposed and the vulnerability cannot be exploited. To disable the Audit Log feature, use the following settings. Depending on your existing configuration, the logger index may vary. [CmpLog] Logger.0.Name=.Audit.log Logger.0.Enable=0

Risk Evaluation

Two local privilege escalation vulnerabilities were identified in the CODESYS Development System. Specifically, the PackageManager and the IPM create temporary directories with insecure default permissions when executed with administrative privileges. This allows low-privileged local users to modify a temporary bootstrap file to force the deployment of arbitrary components, or to exploit a Time-of-Check to Time-of-Use (TOCTOU) race condition to replace digitally verified installation files with malicious ones prior to installation. Both flaws bypass intended security boundaries during the installation of packages or add-ons.

Zusammenfassung der Gegenmaßnahmen

Update the following product to version 3.5.22.20. * CODESYS Development System The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

Risk Evaluation

A vulnerability in the CODESYS Visualization login dialog has been identified. During logins within the CODESYS Visualization, authentication data may not be sufficiently isolated when multiple users perform login operations concurrently. As a result, an authenticated visualization user may be able to obtain credentials entered by another visualization user. The issue affects only login operations within an active visualization session and can be triggered via local and remote access to the visualization.

Zusammenfassung der Gegenmaßnahmen

Two alternative mitigation options have been identified. One option is to avoid using the Input Action "User Management -> Login" for changing users within an active visualization session. Instead, use the Input Action "User Management -> Logout" to do a complete logout followed by a new Login to the Visualization to re-login with another user. Alternatively, property handling within the visualization can be disabled via Project Settings -> Visualization -> General -> Advanced -> "Activate property handling in all element properties", if this is not required for the compilation of the application.

Risk Evaluation

CODESYS Modbus is an add‑on for the CODESYS Development System that provides a fully integrated Modbus protocol stack along with diagnostic capabilities. A flaw in the CODESYS Modbus TCP Server protocol stack library results in a vulnerability. When a Modbus TCP server is configured, this vulnerable protocol stack is downloaded to and executed by CODESYS Control runtime systems. The vulnerability is caused by a resource management issue in the Modbus TCP server and is only exploitable if a race condition in the connection handling is successfully triggered. Over time, this may exhaust the configured maximum number of connections, potentially preventing new connections from being accepted. Existing connections remain unaffected and continue to operate normally. This issue affects only CODESYS projects that include a Modbus TCP server configuration.

Zusammenfassung der Gegenmaßnahmen

Update the following product to version 4.6.0.0. * CODESYS Modbus To make the fix effective for existing CODESYS projects, you must additionally update the local Modbus TCP Server in the device tree to the latest version and perform a download of the CODESYS application to the PLC. The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

Risk Evaluation

The CODESYS Installer is affected by a privilege escalation vulnerability. Due to a race condition, a local attacker with limited privileges can replace the verified downloaded setup before execution. Because the update process runs with administrator privileges, a malicious application can be executed with elevated rights. The attack requires the legitimate user to confirm the self‑update prompt for the CODESYS Installer itself or to initiate an installation of a CODESYS Development System. The update process for CODESYS Add-Ons is not affected by this issue.

Zusammenfassung der Gegenmaßnahmen

Update the following product to version 2.6.1.0. * CODESYS Installer The CODESYS Installer as well as the CODESYS Development System can be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

Risk Evaluation

A vulnerability has been identified in the CODESYS Control runtime system, which includes an abstraction layer designed to ensure compatibility across different operating systems. This layer is used both by affected CODESYS products and by applications running on the PLC. The platform-specific adaptation of this abstraction layer for Linux and QNX contains a flaw in the SysSocket implementation. Due to incorrect internal handling and depending on how the caller interacts with the affected function, the issue can lead to an out-of-bounds read. An unauthenticated attacker may be able to exploit this vulnerability via socket-based communication, potentially causing a crash of the corresponding communication task. Additionally, also clients such as the PLCHandler running on Linux or QNX may be affected if they connect to a malicious server that triggers the flaw. Successful exploitation requires the attacker to win a race condition, which increases the complexity of the attack. Note: All platforms other than Linux and QNX are not affected.

Zusammenfassung der Gegenmaßnahmen

As the flaw resides in the SysSocketSelect() implementation, which has been switched to a poll()-based approach by default since version 3.5.21.0, the following setting can be added to the configuration file of the affected product (e.g., CODESYSControl.cfg) to revert to the select()-based implementation: [SysSocket] LinuxSelectPoll=1 Note: On Linux select() is limited to less than 1024 file descriptors.

Risk Evaluation

A vulnerability in the CODESYS Control runtime system's CmpVisuServer component allows attackers to cause a denial-of-service (DoS) by sending special request to the CODESYS Web- or remote Target Visu. The issue is triggered by an internal read access using a pointer of wrong type. Only CODESYS Control runtime systems and PLCs based on the CODESYS Runtime Toolkit that include the CmpVisuServer component are impacted. In the case of CODESYS Web Visu, the vulnerability can only be exploited if the web server is running. When the web server starts depends on the startup configuration: By default, it is only running if the PLC executes application code that includes a visualization.

Zusammenfassung der Gegenmaßnahmen

Update the following products to version 3.5.21.40. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS HMI (SL) * CODESYS Remote Target Visu * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

Risk Evaluation

A vulnerability has been discovered in the print engine of the CODESYS development system. If a CODESYS project file or archive file was crafted in a specific way, the CODESYS development system could execute arbitrary code when a user opens these files and configures the print/printer options or prints the project or parts of it. This arbitrary code would be executed in the context of the user who was tricked into opening the project.

Zusammenfassung der Gegenmaßnahmen

Open/install CODESYS archives, projects and packages from trustworthy sources only.

Risk Evaluation

A vulnerability in the CODESYS Control runtime system's CmpDevice component allows unauthenticated attackers to cause a denial-of-service (DoS) via specially crafted communication requests. The issue is triggered by a NULL pointer dereference and also affects systems when outdated CODESYS clients attempt to log in. Only PLCs based on the CODESYS Runtime Toolkit containing the components CmpDevice, CmpAuditLog, and CmpSessionInformation are impacted. **Update 1.1.0, 01.09.2025:** Updated remediation category - fixed SL runtimes are now available.

Zusammenfassung der Gegenmaßnahmen

The vulnerability can be mitigated by restricting the allowed login authentication type "CmpUserMgr/UserLogin_AuthenticationType" to "ONLY_ASYMMETRIC". This can be configured either via the Device Security Settings dialog in the CODESYS Development System or directly in the configuration file of the CODESYS Control runtime system (CODESYSControl.cfg) by adding the following setting: [CmpUserMgr] SECURITY.UserLogin_AuthenticationType=ONLY_ASYMMETRIC With this configuration in place, both potential attackers and legacy CODESYS protocol clients (prior to version 3.5.16.0) will be blocked from logging in, thereby preventing execution of the vulnerable code path.

Risk Evaluation

A vulnerability in the CODESYS Control runtime system allows low-privileged remote attackers to access the PKI folder via CODESYS protocol, enabling them to read and write certificates and keys. This exposes sensitive cryptographic data and allows unauthorized certificates to be trusted. However, all services remain available, only certificate based encryption and signing features are concerned. The issue affects systems using the optional CmpOpenSSL component for cryptographic operations. **Update 1.1.0, 01.09.2025:** Updated remediation category - fixed SL runtimes are now available.

Zusammenfassung der Gegenmaßnahmen

Update the following products to version 3.5.21.20. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS HMI (SL) * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/. Following our general recommendation that the PKI should only be managed via the dedicated X.509 API or the corresponding online services of the CODESYS Control runtime system, the programmatic direct access via SysFile or SysDir operations or online access via the CODESYS file transfer services is denied after an update to a fixed product version. For compatibility reasons, the old behavior can be restored for applications that use these accesses via the following setting: [CmpOpenSSL] EnforceBlacklistOnPKIDir=0 However, we strongly recommend keeping the new default.

Risk Evaluation

On certain operating systems (e.g., Linux), default file system permissions may allow read access to the files of the CODESYS Control runtime system for non-administrator users. The documentation provided with the CODESYS Runtime Toolkit does not explicitly address this risk. As a result, products based on the toolkit may unintentionally expose sensitive runtime files to local operating system users with limited privileges. CODESYS Control runtime system based devices are affected if they provide access to the operating system (e.g., via a local user interface or SSH) and user accounts without administrator rights for this access exist or can be created.

Zusammenfassung der Gegenmaßnahmen

If the CODESYS Control runtime system is operated on an operating system with multi-user support, other users may potentially gain access to runtime-related files. Thus, it is essential to configure the storage locations for CODESYS Control runtime files in accordance with the operating system's security best practices. These locations should, by default, restrict access to unauthorized users. If the operating system does not support such access control mechanisms or if implementing them is not feasible, an alternative approach is to explicitly revoke read and write permissions for all non-administrative users on the directories used by the CODESYS Control runtime system. The following directories must be secured: * The directory containing configuration files * The directory containing binary files * The working directory used by the runtime system Note: Protecting individual files is not sufficient. The entire directories must be secured to ensure that any files created in the future are also protected. Alternatively, where applicable, all non-administrative user accounts can be removed from the system, and their re-creation should be prevented. Additionally, it is recommended to disable remote access methods that allow file access (e.g., SSH) wherever possible, in order to reduce the overall attack surface. Best practice recommendations for Linux and QNX Systems: * Create a dedicated privileged group for accessing the above-mentioned directories, and add the user account under which the runtime process is executed to this group. * Set the file system permissions for these directories to deny access to "other" users (e.g., chmod o-rx). * If access for additional users is required, they can be added to the privileged group as needed.

Risk Evaluation

The CODESYS Key USB dongle, which is based on WIBU CodeMeter technology, is affected by a physical side-channel vulnerability.

Zusammenfassung der Gegenmaßnahmen

Update the CODESYS Key firmware to version 4.52. Updating the firmware also protects the future usage of additional CODESYS Key features by the CODESYS software and general usage by other software. The update can be installed, for example, via the CodeMeter Control Center.

Risk Evaluation

A low privileged attacker with physical access to a controller, that supports removable media and is running a CODESYS Control runtime system, can exploit the insufficient path validation by connecting removable media with a file system supporting symbolic links. This could allow the attacker to bypass SysFile restrictions and gain unauthorized access to the entire file system.

Zusammenfassung der Gegenmaßnahmen

Regardless of the vulnerability described here, CODESYS GmbH recommends that physical access to the controller should only be granted to authorized persons. Especially in the case of productive control systems, physical manipulation of the controller can affect the controlled machine or process. This generally recommended restriction of access also reduces the attack surface for this vulnerability, as its exploitation requires physical access. To exploit this vulnerability, a successful login to the affected product is required. The online user management therefore protects from exploiting this security vulnerability. CODESYS GmbH strongly recommends using the online user management, which is enforced by default. This not only prevents from accessing the file system with malicious symbolic links, but also suppresses modifying the PLC application, or starting, stopping, debugging or other actions on a known working PLC application that could potentially disrupt a machine or system. To fully mitigate this vulnerability, system administrators can restrict the use of removable media to devices that do not support symbolic links, such as FAT16 or FAT32. Since these file systems lack symbolic link functionality, this effectively prevents any symbolic link-based attacks. Alternatively, remove PlaceHolderFilePath settings from the CODESYS Control configuration file, which point to removable media such as: [SysFile] PlaceholderFilePath.1=/media/usb, $USB$