CVE-2021-30187

CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command...

3S-Smart Software Solutions CODESYS V2 Web-server buffer error vulnerability

3S-Smart Software Solutions CODESYS Control runtime system is an application system from 3S-Smart Software Solutions, Germany. It is used for the conversion of any type of smart device into an IEC 61131-3 controller. An input validation error vulnerability exists in 3S-Smart Software Solutions...

PT-2021-3340 · 3S Smart Software Solutions · Codesys V2 Runtime System

Name of the Vulnerable Software and Affected Versions: CODESYS V2 runtime system SP versions prior to 2.4.7.55 Description: The issue arises from the improper neutralization of special elements used in an OS command, potentially allowing an attacker to impact the confidentiality, integrity, and...

PT-2021-3346 · 3S Smart Software Solutions · Codesys V2 Runtime System

Name of the Vulnerable Software and Affected Versions: CODESYS V2 runtime system SP versions prior to 2.4.7.55 Description: The issue is a stack-based buffer overflow in the CODESYS V2 runtime system SP. This can be exploited by a remote attacker to impact the confidentiality, integrity, and...

3S CoDeSys (Update A)

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit/public exploits are available Vendor: 3S-Smart Software Solutions Equipment: CoDeSys Vulnerabilities: Improper Access Control, Relative Path Traversal 2. UPDATE INFORMATION This updated advisory is a...

CVE-2020-6081

An exploitable code execution vulnerability exists in the PLCTask functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially crafted network request can cause remote code execution. An attacker can send a malicious packet to trigger this vulnerability...

Design/Logic Flaw

An exploitable code execution vulnerability exists in the PLCTask functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially crafted network request can cause remote code execution. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2020-6081

An exploitable code execution vulnerability exists in the PLCTask functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially crafted network request can cause remote code execution. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2020-6081

An exploitable code execution vulnerability exists in the PLCTask functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially crafted network request can cause remote code execution. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2020-6081

CVE-2020-6081 affects 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30 (PLC_Task). A crafted network packet enables remote code execution. TALOS detail shows attackers can upload an app via SSH or Codesys port 11740 without cryptographic verification, bypassing authentication, allowing ...

3S-Smart Software Solutions CODESYS Runtime Remote Code Execution Vulnerability

3S-Smart Software Solutions CODESYS Runtime is a controller real-time runtime system based on IEC61131-3 standard programming from 3S-Smart Software Solutions, Germany. The system transforms any embedded or PC-based device into an IEC61131-3 compliant industrial controller. A security vulnerabili...

CVE-2020-6081: Insufficient Verification of Data Authenticity

An exploitable code execution vulnerability exists in the PLCTask functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially crafted network request can cause remote code execution. An attacker can send a malicious packet to trigger this vulnerability...

PT-2020-18910

Name of the Vulnerable Software and Affected Versions 3S-Smart Software Solutions GmbH CODESYS Runtime version 3.5.14.30 Description An exploitable code execution issue exists in the PLC Task functionality. A specially crafted network request can cause remote code execution. An attacker can send ...

CVE-2019-19789

3S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.54 allow a NULL pointer dereference...

CVE-2019-19789: NULL Pointer Dereference

3S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.54 allow a NULL pointer dereference...

PT-2019-6356

Name of the Vulnerable Software and Affected Versions CODESYS SP Realtime NT versions prior to V2.3.7.28 CODESYS Runtime Toolkit 32 bit full versions prior to V2.4.7.54 CODESYS PLCWinNT versions prior to V2.4.7.54 Description The issue is related to a NULL pointer dereference in the CODESYS SP...

WAGO PFC200 Series Incorrect Authentication Vulnerability

The WAGO PFC200 is a bus editable logic controller module from WAGO Germany. An incorrect authentication vulnerability exists in the WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. The vulnerability originates from the CoDeSys Runtime application being available by default over th...

Stack overflow

A Stack-based Buffer Overflow issue was discovered in 3S-Smart CODESYS Web Server. Specifically: all Microsoft Windows also WinCE based CODESYS web servers running stand-alone Version 2.3, or as part of the CODESYS runtime system running prior to Version V1.1.9.19. A crafted request may cause a...

Authentication flaw

An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An attacker can execute different unauthenticated remote operations because of the CoDeSys Runtime application, which is available via network by default on Port 2455. An attacker...

CVE-2018-5459

An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An attacker can execute different unauthenticated remote operations because of the CoDeSys Runtime application, which is available via network by default on Port 2455. An attacker...