CODESYS Development System Improper Enforcement of Message Integrity Remote Code Execution Vulnerability

2023-08-1400:00:00

Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)

www.zerodayinitiative.com

codesys

development system

message integrity

remote code execution

authentication

learnmoreaction

missing integrity check

notification data

0.001 Low

EPSS

Percentile

49.7%

JSON

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of CODESYS Development System. Authentication is not required to exploit this vulnerability. The specific flaw exists within the LearnMoreAction function. The issue results from a missing integrity check on notification data. An attacker can leverage this vulnerability to execute code in the context of the current user.