title: CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service
description: In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC.
problem types: CWE-755 Improper Handling of Exceptional Conditions
affected:
{
product: CODESYS V2
vendor: CODESYS
versions:
lessThan: V2.4.7.56, status: affected, version: Runtime Toolkit 32 bit full, versionType: custom
lessThan: V2.4.7.56, status: affected, version: PLCWinNT, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
solutions: CODESYS GmbH has released the following product versions to solve the noted vulnerability issue for the affected CODESYS products:
* CODESYS Runtime Toolkit 32 bit full version V2.4.7.56
* CODESYS PLCWinNT version V2.4.7.56. This will also be part of the CODESYS Development System setup version V2.3.9.68.