OSCAT: Out-of-bounds read in OSCAT Basic library

An attacker or a flawed control program could cause the PLC to crash or leak internal data by passing invalid month values to the MONTH_TO_STRING function, potentially interrupting production or revealing sensitive process information.

Manufacturing facilities and utilities that use CODESYS-based PLCs with the OSCAT Basic library for automation tasks, particularly those relying on date/time functions (e.g., alarm logging, schedule-based control, reporting). Any automation process that uses MONTH_TO_STRING in its control logic is at risk.

An attacker with access to modify the PLC application code, or a poorly-validated external input (e.g., from a network interface or sensor), could pass a negative or out-of-bounds month value to the MONTH_TO_STRING function, triggering the out-of-bounds read. This could crash the PLC or expose internal memory contents.