The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to execute commands via the command-line interface in the TCP listener service or transfer files via requests to the TCP listener service.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
CODESYS Control Runtime embedded
Vendor
3S-Smart Software Solutions
Product
CODESYS Control Runtime embedded
Platforms
Unknown
Default status
unaffected
CODESYS Control Runtime embedded · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
2.3.2.8
Unavailable
None listed
CODESYS Control Runtime full
Vendor
3S-Smart Software Solutions
Product
CODESYS Control Runtime full
Platforms
Unknown
Default status
unaffected
CODESYS Control Runtime full · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
2.4.7.40
Unavailable
None listed
CODESYS Control RTE
Vendor
3S-Smart Software Solutions
Product
CODESYS Control RTE
Platforms
Unknown
Default status
unaffected
CODESYS Control RTE · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
2.3.7.17
Unavailable
None listed
CECX-X-C1 Modular Master Controller with CoDeSys
Vendor
Festo
Product
CECX-X-C1 Modular Master Controller with CoDeSys
Platforms
Unknown
Default status
unaffected
CECX-X-C1 Modular Master Controller with CoDeSys · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All
affected
Unavailable
Unavailable
Unavailable
None listed
CECX-X-M1 Modular Controller with CoDeSys and SoftMotion
Vendor
Festo
Product
CECX-X-M1 Modular Controller with CoDeSys and SoftMotion
Platforms
Unknown
Default status
unaffected
CECX-X-M1 Modular Controller with CoDeSys and SoftMotion · Scoped product and version facts