image
A critical flaw in a web server for the CODESYS automation software for engineering control systems could allow a remote, unauthenticated attacker to crash a server or execute code. The bug is rated 10 out of 10 on the CVSS v.2 vulnerability severity scale and requires little skill to exploit, the company said. It’s a heap-based buffer overflow – a class of vulnerability where the region of a process’ memory used to store dynamic variables (the heap) can be overwhelmed – and thus be made inaccessible to other processes. In this case, the bug (CVE-2020-10245) exists in the CODESYS web server, which is used to display CODESYS system visualization screens in a web browser. “This could crash the web server, lead to a denial-of-service condition or may be utilized for remote code execution,” according to the company’s advisory [PDF]. “As the web server is part of the CODESYS runtime system, this may result in unforeseen behavior of the complete runtime system.” CODESYS is a software suite used by automation specialists as a development environment for programming controller applications, often found in industrial environments, according to its website. Developed by the Germany-based company Smart Software Solutions (3S) to make the engineering of automated solutions more convenient, it’s a platform-independent development environment that is compatible with programmable logic controller (PLC) hardware and many other automation components available from hundreds of companies….

Source