PT-2020-11065 · 3S Smart Software Solutions · Codesys Control For Empc-A/Imx6+20

Published 2020-03-26 · Updated 2022-04-29 · CVE-2019-5105

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions 3S-Smart Software Solutions CODESYS GatewayService versions prior to V3.5.16.10 CODESYS Control for BeagleBone versions prior to V3.5.16.10 CODESYS Control for emPC-A/iMX6 versions prior to V3.5.16.10 CODESYS Control for IOT2000 versions prior to V3.5.16.10 CODESYS Control for Linux versions prior to V3.5.16.10 CODESYS Control for PLCnext versions prior to V3.5.16.10 CODESYS Control for PFC100 versions prior to V3.5.16.10 CODESYS Control for PFC200 versions prior to V3.5.16.10 CODESYS Control for Raspberry Pi versions prior to V3.5.16.10 CODESYS Control RTE V3 versions prior to V3.5.16.10 CODESYS Control RTE V3 (for Beckhoff CX) versions prior to V3.5.16.10 CODESYS Control Win V3 versions prior to V3.5.16.10 CODESYS Control V3 Runtime System Toolkit versions prior to V3.5.16.10 CODESYS V3 Embedded Target Visu Toolkit versions prior to V3.5.16.10 CODESYS V3 Remote Target Visu Toolkit versions prior to V3.5.16.10 CODESYS V3 Safety SIL2 versions prior to V3.5.16.10 CODESYS Edge Gateway V3 versions prior to V3.5.16.10 CODESYS Gateway V3 versions prior to V3.5.16.10 CODESYS HMI V3 versions prior to V3.5.16.10 CODESYS OPC Server V3 versions prior to V3.5.16.10 CODESYS PLCHandler SDK versions prior to V3.5.16.10 CODESYS V3 Simulation Runtime versions prior to V3.5.16.10

Description An exploitable memory corruption issue exists in the Name Service Client functionality of the CODESYS GatewayService. A specially crafted packet can cause a large memcpy, resulting in an access violation and termination of the process. An attacker can send a packet to a device running the GatewayService.exe to trigger this issue.

Recommendations For all versions prior to V3.5.16.10, update to version V3.5.16.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the GatewayService.exe to minimize the risk of exploitation. Avoid using the Name Service Client functionality in the affected CODESYS products until the issue is resolved. At the moment, there is no other information about additional mitigation measures.

Exploit

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

CVE-2019-5105

Affected Products

Codesys Control Rte V3

Codesys Control V3 Runtime System Toolkit

Codesys Control Win V3

Codesys Control For Beaglebone

Codesys Control For Iot2000

Codesys Control For Linux

Codesys Control For Pfc100

Codesys Control For Pfc200

Codesys Control For Plcnext

Codesys Control For Raspberry Pi

Codesys Control For Empc-A/Imx6

Codesys Edge Gateway V3

Codesys Gateway V3

Codesys Gateway Server

Codesys Hmi V3

Codesys Opc Server V3

Codesys Plchandler Sdk

Codesys V3 Embedded Target Visu Toolkit

Codesys V3 Remote Target Visu Toolkit

Codesys V3 Safety Sil2

Codesys V3 Simulation Runtime

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0897 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5105 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5105 · Security Note
• https://t.me/cibsecurity/10817 · Telegram Post
• https://t.me/cvenotify/2193 · Telegram Post
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13077&token=3bfc6d1d08415a6260b96093520071f5786e7fd4&download= · Note