CODESYS, a developer of industrial automation software, notified customers this month of a dozen vulnerabilities impacting a variety of devices. Cisco Talos detected more than half of these issues, and the details were released on Monday.
Vulnerabilities in CODESYS software could have substantial consequences because it is utilised in several large firms’ industrial control systems (ICS). Last month, a cybersecurity firm warned that serious security holes uncovered in CODESYS software exposed programmable logic controllers (PLCs) made by more than a dozen manufacturers to attacks.
CODESYS announced on July 22 that patches for remote code execution, denial of service (DoS), and information disclosure vulnerabilities in its Development System, V3 web server, Gateway, Runtime Toolkit for VxWorks, and EtherNetIP products are now available.
A critical severity rating has been applied to only one vulnerability. The bug, dubbed CVE-2021-33485, is a heap-based buffer overflow in the CODESYS V3 web server that can be used to launch DoS attacks or execute remote code using specially crafted requests.
Cisco’s Talos research and threat intelligence unit uncovered seven vulnerabilities, according to a CODESYS alert. Researchers from Talos discovered that unsafe deserialization flaws in the CODESYS Development System, a programming tool for industrial control and automation systems, can lead to remote code execution.
An attacker could take advantage of these flaws by altering local configuration or profile files, or duping a local user into opening malicious project or archive files.
The manufacturer stated that it was unaware of any attacks exploiting these holes, but that security scanners can exacerbate some of the flaws.
CODESYS stated in each advisory that the vulnerabilities can be exploited by an attacker with limited capabilities.
