Schneider Electric devices using CODESYS Runtime

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

The vulnerabilities in the extensions for the development environment CODESYS SP Realtime NT, CODESYS Runtime Toolkit, and CODESYS PLCWinNT allow a attacker to cause service interruptions.

The vulnerability of the extensions for the development environment CODESYS SP Realtime NT, CODESYS Runtime Toolkit, and CODESYS PLCWinNT is related to the handling of the zero pointer. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

The vulnerability of the EnginePlugin plugin of the Application Programming Platform PLC CODESYS Development System allows a perpetrator to execute any command they desire.

The vulnerability of the EnginePlugin plugin of the PLK CODESYS Development System is related to the deserialization of unreliable data. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary commands...

The vulnerability of the Project.get_MissingTypes() function in the ObjectManager plugin of the PLK CODESYS Development System application programming interface allows a attacker to execute any command they desire.

The vulnerability of the Project.getMissingTypes function in the ObjectManager plugin of the PLK CODESYS Development System lies in the deserialization of unreliable data. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...

CVE-2023-1620

Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime...

CVE-2023-1620

Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime...

Design/Logic Flaw

Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime...

CVE-2023-1620 WAGO: DoS in multiple products in multiple versions using Codesys

Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime...

CVE-2023-1620

CVE-2023-1620 affects WAGO devices using the CODESYS V2 runtime (WAGO 750 controllers). An authenticated attacker with high privileges can cause a Denial of Service by sending a specifically crafted packet to the CODESYS V2 runtime. Available sources indicate DoS as the impact; no public exploit ...

CVE-2023-1620 WAGO: DoS in multiple products in multiple versions using Codesys

Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime...

WAGO 输入验证错误漏洞

WAGO is a 750-88x series programmable logic controller from WAGO, Germany. The device is designed for use in industrial environments where digital algorithms operate electronic systems. An input validation error vulnerability exists in the WAGO PFC200 Family, which can be exploited by an...

WAGO 输入验证错误漏洞

WAGO is a 750-88x series programmable logic controller from WAGO, Germany. The device is designed for use in industrial environments where digital algorithms operate electronic systems. An input validation error vulnerability exists in the WAGO PFC200 Family, which can be exploited by an...

CVE-2023-1620: Improper Validation of Consistency within Input

Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime...

PT-2023-3455 · Wago · Wago 750

Name of the Vulnerable Software and Affected Versions: WAGO 750 versions affected versions not specified Description: The issue is related to insufficient input validation in the software of WAGO 750 programmable logic controllers. It may allow a remote attacker to cause a denial of service using...

The software system of Schneider Electric’s industrial automation solutions, Codesys, has vulnerabilities. These vulnerabilities allow attackers to cause a loss of control and trigger malfunctions during maintenance operations.

The vulnerability of the Codesys software suite for industrial automation integrated into Schneider Electric’s programmable logic controllers is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability can allow a malicious actor to gain control and caus...

The vulnerability of the CODESYS Control Runtime software allows a perpetrator to trigger a service failure or execute arbitrary code.

The vulnerability of the CODESYS Control Runtime software lies in a buffer overflow condition. Exploiting this vulnerability allows an attacker to cause service failures or execute arbitrary code...

The vulnerability of the CmpUserMgr component in the Codesys industrial automation software suite allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the CmpUserMgr component in the Codesys industrial automation software suite is related to the use of a unreliable cryptographic algorithm. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of the Codesys industrial automation software suite is related to errors in the assignment of the zero pointer, which allows a malicious actor to trigger a service failure.

The vulnerability of the Codesys industrial automation software suite is related to errors in the assignment of the zero pointer. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

The vulnerability of the Codesys software suite for industrial automation integrated into Schneider Electric’s programmable logic controllers allows a perpetrator to compromise data integrity.

The vulnerability of the Codesys software suite for industrial automation integrated into Schneider Electric’s programmable logic controllers is related to the disclosure of information in the incorrect data field. Exploiting this vulnerability could allow a malicious actor to compromise the...

The vulnerability of the ComponentModel Profile.FromFile() function in the application programming complex of the PLC CODESYS Development System allows a perpetrator to execute arbitrary commands.

The vulnerability of the ComponentModel Profile.FromFile function in the CODESYS Development System application framework is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary commands...