CVE-2019-5105

Name of the Vulnerable Software and Affected Versions 3S-Smart Software Solutions CODESYS GatewayService versions prior to V3.5.16.10 CODESYS Control for BeagleBone versions prior to V3.5.16.10 CODESYS Control for emPC-A/iMX6 versions prior to V3.5.16.10 CODESYS Control for IOT2000 versions prior to V3.5.16.10 CODESYS Control for Linux versions prior to V3.5.16.10 CODESYS Control for PLCnext versions prior to V3.5.16.10 CODESYS Control for PFC100 versions prior to V3.5.16.10 CODESYS Control for PFC200 versions prior to V3.5.16.10 CODESYS Control for Raspberry Pi versions prior to V3.5.16.10 CODESYS Control RTE V3 versions prior to V3.5.16.10 CODESYS Control RTE V3 (for Beckhoff CX) versions prior to V3.5.16.10 CODESYS Control Win V3 versions prior to V3.5.16.10 CODESYS Control V3 Runtime System Toolkit versions prior to V3.5.16.10 CODESYS V3 Embedded Target Visu Toolkit versions prior to V3.5.16.10 CODESYS V3 Remote Target Visu Toolkit versions prior to V3.5.16.10 CODESYS V3 Safety SIL2 versions prior to V3.5.16.10 CODESYS Edge Gateway V3 versions prior to V3.5.16.10 CODESYS Gateway V3 versions prior to V3.5.16.10 CODESYS HMI V3 versions prior to V3.5.16.10 CODESYS OPC Server V3 versions prior to V3.5.16.10 CODESYS PLCHandler SDK versions prior to V3.5.16.10 CODESYS V3 Simulation Runtime versions prior to V3.5.16.10

Description An exploitable memory corruption issue exists in the Name Service Client functionality of the CODESYS GatewayService. A specially crafted packet can cause a large memcpy, resulting in an access violation and termination of the process. An attacker can send a packet to a device running the GatewayService.exe to trigger this issue.

Recommendations For all versions prior to V3.5.16.10, update to version V3.5.16.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the GatewayService.exe to minimize the risk of exploitation. Avoid using the Name Service Client functionality in the affected CODESYS products until the issue is resolved. At the moment, there is no other information about additional mitigation measures.