PT-2021-7779 · 3S Smart Software Solutions · Codesys Development System

Published 2021-08-05 · Updated 2022-09-30 · CVE-2021-21863

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CODESYS Development System versions 3.5.16 through 3.5.17

Description A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality. This issue is related to deficiencies in the deserialization mechanism, allowing an attacker to execute arbitrary commands by providing a specially crafted file. The vulnerability can be triggered when a malicious file is used, leading to potential command execution.

Recommendations For versions 3.5.16 and 3.5.17, consider disabling the Profile.FromFile() function until a patch is available to prevent exploitation. Restrict access to files that could be used to trigger this vulnerability to minimize the risk of arbitrary command execution.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-02777

CVE-2021-21863

Affected Products

Codesys Development System

References · 9

• https://bdu.fstec.ru/vul/2023-02777 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21863 · Security Note
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16805&token=ee583c498941d9fda86490bca98ff21928eec08a&download= · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21863 · Vendor Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2021-1300 · Note
• https://t.me/cvenotify/36966 · Telegram Post
• https://vuldb.com/ru/?id.180206 · Note
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16805&token=ee583c498941d9fda86490bca98ff21928eec08a&download= · Note
• https://se.com/ae/en/download/document/SEVD-2022-011-06 · Note