PT-2021-7766 · 3S Smart Software Solutions · Codesys Development System

Patrick Desantis

·

Published

2021-08-02

·

Updated

2022-09-30

·

CVE-2021-21864

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions CODESYS Development System versions 3.5.16 through 3.5.17
Description A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality. This issue can be exploited by providing a specially crafted file, leading to arbitrary command execution. An attacker can trigger this vulnerability by supplying a malicious file.
Recommendations For versions 3.5.16 and 3.5.17, consider disabling the ComponentManager.StartupCultureSettings functionality until a patch is available to prevent exploitation. Restrict access to the vulnerable component to minimize the risk of arbitrary command execution. Avoid using malicious files that can trigger this issue until the vulnerability is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-02706
CVE-2021-21864

Affected Products

Codesys Development System