3S-Smart Software Solutions GmbH CODESYS V3 Web Server

Risk Summary

Successful exploitation of these vulnerabilities may allow an attacker to create a denial-of-service condition, to perform remote code execution, or to access restricted files.

CVEs (2)

Remediations

• 3S-Smart Software Solutions GmbH has released Versions 3.5.12.80, 3.5.14.10, and 3.5.15.0 to resolve the vulnerabilities for the affected CODESYS products.
• Please visit the CODESYS update page for more information on how to obtain the software update: https://www.codesys.com/download/
• Updating to Version 3.5.14.10 or higher is recommended over Version 3.5.12.80, which does not resolve the vulnerabilities for all affected products.
• Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.
• Use firewalls to protect and separate the control system network from other networks.
• Use VPN (virtual private networks) tunnels if remote access is required.
• Activate and apply user management and password features.
• Limit the access to both development and control system by physical means, operating system features, etc.
• Protect both development and control system by using up-to-date virus detecting solutions. For more information and general recommendations for protecting machines and plants, see also the CODESYS security whitepaper at https://customers.codesys.com/fileadmin/data/customers/security/CODESYS-Security-Whitepaper.pdf

Affected Vendors

Affected Products (14)

Affected Sectors

Critical Manufacturing