CVE-2021-34593 CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service

What is CVE-2021-34593?

CVE-2021-34593 is a high-severity denial of service vulnerability in CODESYS V2, published on 26 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC.

Weakness: CWE-755

Which versions are affected by CVE-2021-34593?

It affects 15 products.

Products include Codesys Plcwinnt, Codesys Runtime Toolkit, Wago 750-8202 Firmware, Wago 750-8203 Firmware, Wago 750-8204 Firmware, Wago 750-8206 Firmware and 9 more.

How do I fix CVE-2021-34593?

No fix has been published for CVE-2021-34593 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-34593 being exploited?

There is no known exploitation of CVE-2021-34593 in the wild and no public exploit code.

Other vulnerabilities in CODESYS V2

• CVE-2022-31806 Insecure default settings in CODESYS Runtime Toolkit 32 bit full and CODESYS PLCWinNT Critical 9.8
• CVE-2022-32137 CODESYS Runtime System prone to heap based buffer overflow High 8.8
• CVE-2022-32138 CODESYS runtime system prone to denial of service due to Unexpected Sign Extension High 8.8
• CVE-2022-32143 CODESYS runtime system prone to directory acces High 8.8
• CVE-2022-1965 CODESYS runtime system prone to file deletion due to improper error handling High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mp42-p5v3-r5p6.