| Package | Affected versions | Patched versions |
|---|---|---|
| control for beaglebone | < 3.5.16.0 | 3.5.16.0 |
| control for empc-a/imx6 | < 3.5.16.0 | 3.5.16.0 |
| control for iot2000 | < 3.5.16.0 | 3.5.16.0 |
| control for linux | < 3.5.16.0 | 3.5.16.0 |
| control for pfc100 | < 3.5.16.0 | 3.5.16.0 |
| control for pfc200 | < 3.5.16.0 | 3.5.16.0 |
| control for plcnext | < 3.5.16.0 | 3.5.16.0 |
| control for raspberry pi | < 3.5.16.0 | 3.5.16.0 |
| control rte v3 | < 3.5.16.0 | 3.5.16.0 |
| control v3 runtime system toolkit | < 3.5.16.0 | 3.5.16.0 |
| control win v3 | < 3.5.16.0 | 3.5.16.0 |
| hmi v3 | < 3.5.16.0 | 3.5.16.0 |
| v3 simulation runtime | < 3.5.16.0 | 3.5.16.0 |
| pmc | ≥ 3.0.0, < 3.5.17 | 3.5.17 |
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free