VulnerabilityModified

CVE-2021-29242

CODESYS Control Runtime system before 3.5.17.0 has improper input validation.

HIGH 7.3EPSS 1.07%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.07%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.

CVSS 3.1: 7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS: 1.07% probability · 63th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: codesys/control for beaglebone sl · codesys/control for empc-a\/imx6 sl · codesys/control for iot2000 sl · codesys/control for linux arm sl · codesys/control for linux sl · codesys/control for pfc100 sl · codesys/control for pfc200 sl · codesys/control for plcnext sl · codesys/control for raspberry pi sl · codesys/control for wago touch panels 600 sl · codesys/control rte · codesys/control runtime system toolkit · codesys/control win · codesys/edge gateway · codesys/embedded target visu toolkit · codesys/gateway · codesys/hmi · codesys/opc server · codesys/plchandler · codesys/remote target visu toolkit · +2 more
Source: cve@mitre.org

References

https://customers.codesys.com/index.phpPermissions Required, Vendor Advisory
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14640&token=623b6fceb0579ef0f7505e29beefa5b3f8ac7873&download=Vendor Advisory
https://www.codesys.com/security/security-reports.htmlVendor Advisory
https://customers.codesys.com/index.phpPermissions Required, Vendor Advisory
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14640&token=623b6fceb0579ef0f7505e29beefa5b3f8ac7873&download=Vendor Advisory
https://www.codesys.com/security/security-reports.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.