PT-2021-7813 · 3S Smart Software Solutions · Codesys Control Runtime System

Published 2021-08-03 · Updated 2021-08-30 · CVE-2021-33485

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CODESYS Control Runtime system versions prior to 3.5.17.10

Description The issue is a Heap-based Buffer Overflow that can be exploited by a remote attacker, potentially leading to a denial of service or the execution of arbitrary code.

Recommendations For versions prior to 3.5.17.10, update to version 3.5.17.10 or later to resolve the issue.

Fix

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-122

CWE-787

Related Identifiers

BDU:2023-03154

CVE-2021-33485

Affected Products

Codesys Control Runtime System

References · 7

• https://bdu.fstec.ru/vul/2023-03154 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-33485 · Security Note
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14805&token=f0b86f99bb302ddd4aadec483aed5f5d3fddbf1a&download= · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33485 · Vendor Advisory
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14805&token=f0b86f99bb302ddd4aadec483aed5f5d3fddbf1a&download= · Note
• https://t.me/cibsecurity/26764 · Telegram Post
• https://se.com/ae/en/download/document/SEVD-2022-011-06 · Note