In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.
En múltiples productos Codesys en múltiples versiones , después de una autenticación exitosa como usuario, las solicitudes de comunicación de red especialmente diseñadas pueden utilizar el componente CmpApp para descargar archivos con cualquier extensión de archivo al controlador. A diferencia de la descarga de archivos normal a través de CmpFileTransfer, aquí no se realiza ningún filtrado de determinados tipos de archivos. Como resultado, la integridad del sistema de ejecución de control CODESYS puede verse comprometida por los archivos cargados en el controlador.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | HIGH |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-552
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| codesys | control_for_beaglebone_sl | * | <built-in method update of dict object at 0x7e60eb2e3bc0> | Application |
| codesys | control_for_empc-a\/imx6_sl | * | <built-in method update of dict object at 0x7e60a8a54d00> | Application |
| codesys | control_for_iot2000_sl | * | <built-in method update of dict object at 0x7e60a8a57840> | Application |
| codesys | control_for_linux_sl | * | <built-in method update of dict object at 0x7e60a8a54540> | Application |
| codesys | control_for_pfc100_sl | * | <built-in method update of dict object at 0x7e60eb2e1240> | Application |
| codesys | control_for_pfc200_sl | * | <built-in method update of dict object at 0x7e60eb2e3b00> | Application |
| codesys | control_for_plcnext_sl | * | <built-in method update of dict object at 0x7e611232c380> | Application |
| codesys | control_for_raspberry_pi_sl | * | <built-in method update of dict object at 0x7e60a8a553c0> | Application |
| codesys | control_for_wago_touch_panels_600_sl | * | <built-in method update of dict object at 0x7e60e8c7e000> | Application |
| codesys | control_rte_sl | * | <built-in method update of dict object at 0x7e60eb2e0f80> | Application |
| codesys | control_rte_sl_\(for_beckhoff_cx\) | * | <built-in method update of dict object at 0x7e60bae4adc0> | Application |
| codesys | control_runtime_system_toolkit | * | <built-in method update of dict object at 0x7e60eb2d86c0> | Application |
| codesys | control_win_sl | * | <built-in method update of dict object at 0x7e60a8a56b40> | Application |
| codesys | development_system | * | <built-in method update of dict object at 0x7e60eb2e1f00> | Application |
| codesys | hmi | * | <built-in method update of dict object at 0x7e613c3cc080> | Application |
| codesys | safety_sil2 | * | <built-in method update of dict object at 0x7e61419fc240> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:codesys:control_for_plcnext_sl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:codesys:control_for_raspberry_pi_sl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:codesys:control_for_wago_touch_panels_600_sl:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:codesys:control_rte_sl_\(for_beckhoff_cx\):*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:codesys:control_runtime_system_toolkit:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:codesys:hmi:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:codesys:safety_sil2:*:*:*:*:*:*:*:* |