3S CoDeSys Runtime Toolkit NULL Pointer Dereference
Low RiskICS-CERT ICSA-14-030-01Nov 2, 2014
Summary
A NULL pointer dereference vulnerability exists in CoDeSys Runtime Toolkit versions prior to 2.4.7.44. The vulnerability could allow an attacker to cause the runtime process to crash, resulting in loss of control logic execution and interruption of any industrial processes dependent on the runtime. No vendor patch is planned for this issue.
What this means
What could happen
A NULL pointer dereference in CoDeSys Runtime Toolkit could cause the runtime to crash, interrupting PLC operations and any processes controlled by the affected runtime system.
Who's at risk
Water utilities, electric utilities, and any industrial operators using CoDeSys Runtime Toolkit for PLC control logic execution. This affects plants where unplanned runtime crashes would disrupt water treatment, pumping, electrical distribution, or other critical processes.
How it could be exploited
An attacker with network access to the CoDeSys Runtime could send a specially crafted input or trigger a specific code path that dereferences a NULL pointer, causing the runtime process to crash and stop executing control logic.
Prerequisites
- Network access to the CoDeSys Runtime Toolkit port or interface
- Ability to send or manipulate input to the runtime (may not require authentication)
no patch availableaffects control system availabilityremotely exploitable
Exploitability
Moderate exploit probability (EPSS 2.0%)
Affected products (1)
ProductAffected VersionsFix Status
CoDeSys Runtime Toolkit: <2.4.7.44<2.4.7.44No fix (EOL)
Remediation & Mitigation
0/3
Mitigations - no patch available
0/3CoDeSys Runtime Toolkit: <2.4.7.44 has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:
HARDENINGIsolate CoDeSys Runtime systems from untrusted networks using network segmentation (firewalls, air-gapping where feasible)
HARDENINGMonitor network traffic to and from CoDeSys Runtime systems for suspicious or unexpected connections
HARDENINGImplement strict access controls to engineering workstations and limit who can modify runtime configurations
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/4434ac6f-1306-4988-983b-a8376c5ed436