QID 591223

Date Published: 2022-12-12

QID 591223: 3S-Smart CODESYS GmbH Visualization Observable Response Discrepancy Vulnerability (Advisory 2022-14)

AFFECTED PRODUCTS
All CODESYS Visualization versions prior to V4.2.0.0 provide a weak login dialog and inject it into the generated code, which is downloaded to and executed by the HMI or PLC.
CODESYS Visualization versions prior to V3.5.17.0 were provided as integrated plugins of the CODESYS Development System. This means that all CODESYS Development System versions before V3.5.17.0 generate a vulnerable login-dialog.
As of CODESYS Development System V3.5.17.0, CODESYS Visualization is provided as an optional Add-on and can be updated separately. CODESYS Visualization V4.0.0.0 was the first version to be made available as an optional Add-on and delivered together with CODESYS Development System V3.5.17.0. Thus, the Visualization Add-on versions from V4.0.0.0 and before V4.2.0.0 generate a vulnerable login-dialog.

QID Detection Logic (Authenticated)
QID checks for the Vulnerable version using windows registry keys

CVSS V3 rated as Medium - 5.3 severity.

CVSS V2 rated as Low - 0 severity.

Solution

The vendor has released a patch version , for more information kindly visit Advisory 2022-14

Vendor References

Advisory 2022-14 - customers.codesys.com/index.php?eID=dumpFile&t=f&f=17142&token=a3696ab41fef800d2eaee8043d4 0d5fbe94277fd&download=

CVEs related to QID 591223

CVE-2022-1989 |

Software Advisories

Advisory ID	Software	Component	Link
Advisory 2022-14			customers.codesys.com/index.php?eID=dumpFile&t=f&f=17142&token=a3696ab41fef800d2eaee8043d4 0d5fbe94277fd&download=

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].