Pierluigi Paganini
February 02, 2018
Security researcher Zhu WenZhe from Istury IOT discovered a critical stack-based buffer overflow vulnerability in the web server component of 3S-Smart Software Solutions’ CODESYS WebVisu product that allows users to view human-machine interfaces (HMIs) for programmable logic controllers (PLCs) in a web browser.
The vulnerability is tracked as CVE-2018-5440 and it has been assigned a CVSS score of 9.8, and the worst news is that it is quite easy to exploit.
The WebVisu product is currently used in 116 PLCs and HMIs from many vendors, including Schneider Electric, Hitachi, Advantech, Berghof Automation, Hans Turck, and NEXCOM.
An attacker can remotely trigger the flaw to cause a denial-of-service (DoS) condition and under some conditions execute arbitrary code on the web server.
“A crafted request may cause a buffer overflow and could therefore execute arbitrary code on the web server or lead to a denial-of-service condition due to a crash in the web server. ” reads the security advisory issued by CODESYS.
According to CODESYS, there is no evidence that the flaw has been exploited in the wild.
The flaw affects all Microsoft Windows (also WinCE) based CODESYS V2.3 web servers running stand-alone or as part of the CODESYS runtime system prior version V1.1.9.19.
The company has released the CODESYS web server V.1.1.9.19 for CODESYS V2.3 to
address the flaw. This is also part of the CODESYS setup V2.3.9.56.
The vendor also recommends organizations to restrict access to controllers, use firewalls to control the accesses and VPNs.
In December 2017, security researchers at SEC Consult discovered a flaw in version 2.4.7.0 of the CODESYS runtime which is included on PFC200s with firmware version 02.07.07. The CODESYS runtime is commonly included on PLCs to allow for easy programming by users. 17 models of WAGO PFC200 Series PLC were found vulnerable to remote exploit.
A PLC flaw can be a serious threat to production and critical infrastructure
Back to the present, querying the Shodan search engine for port 2455 used by CODESYS protocol we can find more than 5,600 systems are exposed online, most of them in the United States, Germany, Turkey, and China.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – WannaMine , cryptocurrency miner)
[adrotate banner=”5″]
[adrotate banner=”13″]
