CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
AI Score
Confidence
Low
EPSS
Percentile
86.2%
This updated advisory is a follow-up to the original advisory titled ICSA-13-011-01 3S CoDeSys that was published January 10, 2013, on the ICS webpage on us-cert.gov.
Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access and obtain administrative privileges.
The following 3S CoDeSys Runtime versions are affected:
--------- Begin Update A Part 1 of 3 ---------
The CoDeSys Runtime Toolkit is used in several vendorβs products worldwide.
--------- End Update A Part 1 of 3 ---------
The CoDeSys Runtime Toolkit does not require users to authenticate when connecting to the device. An attacker could obtain administrative privileges on the device by default. This could allow the attacker to compromise the availability, integrity, and confidentiality of the device.
---------Begin Update A Part 2 of 3 ---------
CVE-2012-6068 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
--------- End Update A Part 2 of 3 ---------
The CoDeSys Runtime Toolkitβs file transfer functionality does not perform input validation, which allows an attacker to access files and directories outside the intended scope. This may allow an attacker to upload and download any file on the device. This could allow the attacker to affect the availability, integrity, and confidentiality of the device.
--------- Begin Update A Part 3 of 3 ---------
CVE-2012-6069 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
--------- End Update A Part 3 of 3 ---------
Independent researcher Reid Wightman of IOActive, formerly of Digital Bond has validated that the patch, issued by 3S, mitigates theses vulnerabilities.
CoDeSys recommends upgrading to the latest version, which is Version 3. It can be downloaded here.
3S released a patch which implements a password for authentication to the device.
The patch can be downloaded from the CoDeSys Download Center. 3S also recommends the usage of standard security methods like firewalls or virtual private network (VPN) access to prevent unauthorized access to the controller.
CoDeSys Version 3.X is not affected by these vulnerabilities.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on us-cert.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.gov in the Technical Information Paper, ICS-TIP-12-146-01BβTargeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6068
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6069
www.codesys.com/download.html
cisasurvey.gov1.qualtrics.com/jfe/form/SV_9n4TtB8uttUPaM6?product=https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01
cwe.mitre.org/data/definitions/23.html
cwe.mitre.org/data/definitions/284.html
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
store.codesys.com/engineering/codesys.html?___store=en#All%20versions
twitter.com/CISAgov
twitter.com/intent/tweet?text=%203S%20CoDeSys%20%28Update%20A%29+https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01&title=%203S%20CoDeSys%20%28Update%20A%29
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01
www.oig.dhs.gov/
www.us-cert.gov/ics
www.us-cert.gov/ics
www.us-cert.gov/ics/alerts/ICS-ALERT-10-301-01
www.us-cert.gov/ics/recommended-practices
www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B
www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=%203S%20CoDeSys%20%28Update%20A%29&body=www.cisa.gov/news-events/ics-advisories/icsa-13-011-01