CODESYS OSCAT Basic Library Out-of-bounds Read Vulnerability (CVE-2024-6876)

Key Information Vulnerability Description Vulnerability ID: VDE-2024-046 Release Date: 2024-09-10 14:00 (CEST) Update Date: 2024-09-10 17:06 (CEST) Vendor: CODESYS GmbH Affected Products: - CODESYS OSCAT Basic Library - oscat.de OSCAT Basic Library Vulnerability Details Vulnerability Type: Out-of-bounds read (CWE-125) Impact: Allows local, unauthorized attackers to access limited internal data of the PLC, potentially causing service crashes. Impact Description: In the OSCAT Basic Library, the MONTH_TO_STRING function contains an out-of-bounds read vulnerability. Exploitation of this vulnerability may lead to limited access to internal data or cause the PLC to crash. Solution Mitigation: Update the OSCAT Basic Library to version 3.3.5. Recommended Actions: - Use controllers and devices in protected environments to minimize network exposure. - Protect and isolate control system networks using firewalls. - Activate and apply user management and password functions. - Restrict access to development and control systems. - Use encrypted communication links. - If remote access is required, use a VPN (Virtual Private Network) tunnel. - Protect development and control systems with the latest virus detection solutions. Reporting Reporters: Corban Villa, Hithem Lamri, Constantine Doumanidis, Michail Maniatakos Coordination: CERT@VDE and CODESYS Acknowledgments: CODESYS GmbH thanks all participants for their efforts. Additional Information CVE ID: CVE-2024-6876 Last Updated: September 10, 2024, 5:07 PM Severity: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L Product: CODESYS OSCAT Basic Library, oscat.de OSCAT Basic Library Affected Versions: < 3.3.5, < 335

Goal Reached Thanks to every supporter — we hit 100%!

CODESYS OSCAT Basic Library Out-of-bounds Read Vulnerability (CVE-2024-6876)