The vulnerability of the Codesys industrial automation software suite is related to errors in the assignment of the zero pointer, which allows a malicious actor to trigger a service failure.

🗓️ 29 May 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Codesys automation suite has a zero pointer flaw that enables remote attackers to trigger failures.

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2021-29241	17 Mar 202612:00	–	circl
CNNVD	CODESYS 代码问题漏洞	3 May 202100:00	–	cnnvd
CVE	CVE-2021-29241	3 May 202113:17	–	cve
Cvelist	CVE-2021-29241	3 May 202113:17	–	cvelist
GithubExploit	n-days-poc-benchmark-and-dataset	17 Apr 202609:08	–	githubexploit
EUVD	EUVD-2021-15880	7 Oct 202500:30	–	euvd
NCSC	Vulnerabilities fixed in Schneider Electric Modicon M241/M251	10 Feb 202200:00	–	ncsc
NVD	CVE-2021-29241	3 May 202114:15	–	nvd
OSV	CVE-2021-29241	3 May 202114:15	–	osv
Prion	Null pointer dereference	3 May 202114:15	–	prion

Vulners

Node

schneider_electric eurotherm_e+plcRange≤1.3.0.1

OR

codesys_gmbh codesys_edge_gatewayRange3.0–4.1.0.0

OR

codesys_gmbh codesys_control_runtime_system_toolkitRange3.0–3.5.16.70

OR

codesys_gmbh codesys_edge_gatewayRange3.0–3.5.16.70

OR

codesys_gmbh codesys_gatewayRange3.0–3.5.16.70

OR

schneider_electric modicon_m241Range<5.1.9.34

OR

schneider_electric modicon_m251Range<5.1.9.34

OR

schneider_electric eurotherm_e+plcRange<1.4.0.0

OR

schneider_electric ecostruxure_machine_expertRange<2.1.0

Source	Link
customers	www.customers.codesys.com/index.php
codesys	www.codesys.com/security/security-reports.html
se	www.se.com/ae/en/download/document/SEVD-2022-011-06/
web	www.web.nvd.nist.gov/view/vuln/detail

29 May 2023 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 37.5

CVSS 27.8

EPSS0.01418

Codesys automation zero pointer flaw remote attackers service failures