{"id":18693,"date":"2021-11-22T07:54:52","date_gmt":"2021-11-22T07:54:52","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=18693"},"modified":"2026-04-17T18:07:45","modified_gmt":"2026-04-17T18:07:45","slug":"codesys-v2-multiple-high-risk-vulnerabilities-threat-alert","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/codesys-v2-multiple-high-risk-vulnerabilities-threat-alert\/","title":{"rendered":"CODESYS V2 Multiple High-Risk Vulnerabilities Threat Alert"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

Recently, CODESYS officially issued four security update advisories that fixed 10 vulnerabilities in CODESYS V2. NSFOCUS received a letter of acknowledgement from CODESYS for NSFOCUS Gewu Lab’s reporting of three vulnerabilities that were rated high-risk. All of the three vulnerabilities are exploited for attacks via private communication protocols supported by CODESYS runtime. By using these vulnerabilities, attackers may cause a denial of service or downtime, or even enable the target to execute the maliciously compiled exploit code to produce an adverse impact on production, stay detected, steal sensitive data, and launch targeted attacks.<\/p>\n\n\n\n

CVE-2021-30188 (CVSS3.0 Score: 8.8): CWE-121: Stack-based Buffer Overflow<\/p>\n\n\n\n

By sending a specially-crafted request to the affected CODESYS products, attackers could cause a denial of service or remote code execution on the target.<\/p>\n\n\n\n

CVE-2021-34595 (CVSS3.0 Score: 8.1): CWE-823: Use of Out-of-range Pointer Offset<\/p>\n\n\n\n

By sending a specially-crafted request to the affected CODESYS products, attackers may cause a denial of service or local memory overwrite via out-of-bounds read or write.<\/p>\n\n\n\n

CVE-2021-34596 (CVSS3.0 Score: 8.1): CWE-824: Access of Uninitialized Pointer<\/p>\n\n\n\n

By sending a specially-crafted request to the affected CODESYS products, attackers may cause a denial of service via access to an uninitialized pointer. CODESYS is a manufacturer-independent IEC 61131-1 programming software and ICS device core (runtime SDK), released by the 3S-Smart Software Solutions Company in Germany, the world’s most renowned soft PLC kernel software R&D manufacturer. As a standard hardware-independent runtime supported by many hardware vendors, CODESYS is compatible with programing environments compliant with the full version of IEC61131 and also supports six programing languages. Besides, CODESY complements portfolio products such as bus configuration programs and motion control systems in different fields. CODESYS runtime supports the following hardware platforms:<\/p>\n\n\n\n

\"Red<\/a><\/figure>\n\n\n\n

Reference link: https:\/\/www.codesys.com\/security\/security-reports.html<\/a><\/p>\n\n\n\n

Scope of Impact<\/h2>\n\n\n\n

Affected Versions<\/strong><\/p>\n\n\n\n