CODESYS Development System V3
CODESYS Security Advisory 2023-08
Published: 2023-08-03© CODESYS Group2/3

1

CODESYS Security Advisory 2023-08

Overview

The CODESYS Development System does not limit the number of attempts to guess the password within an
import dialog.

2

Affected Products

CODESYS Development System versions prior to 3.5.19.20

3

Vulnerability Identifiers, Type and Severity

VDE-2023-023 [1]CODESYS JIRA: CDS-76333, CDS-84600
CVE-2023-3669 [7]CWE-307: Improper Restriction of Excessive Authentication Attempts [8]CVSS v3.1 Base Score 3.3 | Low | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N [9]4Impact

Template: templ_tecdoc_en_V3.0.docx

The CODESYS Development System is an IEC 61131-3 programming tool for the industrial controller andautomation technology sector. Both CODESYS projects and the CODESYS Control Runtime system areprotected by a user management.
The CODESYS Development System offers the option to transfer users from the CODESYS project usermanagement into the CODESYS Control runtime user management. For this purpose, there is an importfunctionality in the device editor dialog for the PLC. During the import, the correct password must be entered foreach imported user. However, this password query ignores the maximum number of incorrect entries defined inthe project. This means that an attacker can make any number of attempts to guess the password via thisimport dialog.

5Remediation

Update the CODESYS Development System to version 3.5.19.20.
The CODESYS Development System can be downloaded and installed directly with the CODESYS Installer or
be downloaded from the CODESYS Store.
Alternatively, you will find further information on obtaining the software update in the CODESYS Update area
[4].

6General Security Recommendations

As part of a security strategy, CODESYS GmbH strongly recommends at least the following best-practice
defense measures:• Use controllers and devices only in a protected environment to minimize network exposure and ensure thatthey are not accessible from outside• Use firewalls to protect and separate the control system network from other networks• Activate and apply user management and password features• Limit the access to both development and control system by physical means, operating system features, etc.
• Use encrypted communication links© CODESYS Group3/3

CODESYS Security Advisory 2023-08• Use VPN (Virtual Private Networks) tunnels if remote access is required• Protect both development and control system by using up to date virus detecting solutions
For more information and general recommendations for protecting machines and plants, see also theCODESYS Security Whitepaper [2].

7Acknowledgments

This vulnerability was reported by an OEM customer.
Coordination done by CERT@VDE.
CODESYS GmbH thanks all parties involved for their efforts.

8Further Information

For additional information regarding the CODESYS products, especially the above-mentioned versions, or about
the described vulnerability please contact the CODESYS support team [6].

9Disclaimer

CODESYS GmbH assumes no liability whatsoever for indirect, collateral, accidental or consequential losses
that occur by the distribution and/or use of this document or any losses in connection with the distribution and/oruse of this document. All information published in this document is provided on good faith by CODESYS GmbH.
Insofar as permissible by law, however, none of this information shall establish any guarantee, commitment orliability on the part of CODESYS GmbH.
Note: Not all CODESYS features are available in all territories. For more information on geographic restrictions,please contact sales@codesys.com.

Template: templ_tecdoc_en_V3.0.docx

10 Bibliography[1] CERT@VDE: https://cert.vde.com[2] CODESYS GmbH: CODESYS Security Whitepaper[3] CODESYS GmbH: Coordinated Disclosure Policy[4] CODESYS GmbH update area: https://www.codesys.com/download[5] CODESYS GmbH security information page: https://www.codesys.com/security[6] CODESYS GmbH support contact site: https://www.codesys.com/support[7] Common Vulnerabilities and Exposures (CVE): https://cve.mitre.org[8] Common Weakness Enumeration (CWE): https://cwe.mitre.org[9] CVSS Calculator: https://www.first.org/cvss/calculator/3.1
The latest version of this document can be found here:
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17768&token=9d206ea9e0449cd9d3ee60d517
9d2761dad2d2dd&download=

Change History
VersionDescription

Date

1.0

Initial version

2023-07-20

2.0

Software Update available

2023-08-03© CODESYS Group