Ransomwarecritical
Several New Critical Flaws Affect CODESYS Industrial Automation Software
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-15782 | A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl | 9.8 | 5% | ||
| CVE-2021-22779 | Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro)… | 9.1 | 1% | ||
| CVE-2021-29238 | CODESYS Automation Server before 1.16.0 allows cross-site request forgery (CSRF) | 8.8 | <1% | ||
| CVE-2021-29240 | The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before installation and may be used to install… | 7.8 | <1% | PoC | |
| CVE-2021-29241 | CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS) | 7.5 | 1% | ||
CVE-2021-34569+3 related CVEs | In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnostic tool and write… | 9.8 group max | <1% |
From the original article
4 min read at thehackernews.com
Cybersecurity researchers on Wednesday disclosed multiple security vulnerabilities impacting CODESYS automation software and the WAGO programmable logic controller (PLC) platform that could be remotely exploited to take control of a company's cloud operational technology (OT) infrastructure.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.