Summary
This document is a security advisory detailing vulnerabilities in the CODESYS Development System V2.3, specifically versions prior to 2.3.9.73. It outlines how local attackers can exploit these vulnerabilities by opening malicious project files, which may lead to system crashes or arbitrary code execution. The advisory identifies two specific vulnerabilities: CVE-2023-49675, categorized as an out-of-bounds write issue with a high severity rating of 7.8, and CVE-2023-49676, a use-after-free vulnerability with a medium severity rating of 5.5. The document recommends updating the software to version 2.3.9.73 to mitigate these risks, as this version prevents the opening of corrupt project files. Additionally, it advises users to only open projects from trusted sources and to implement best-practice security measures, such as using firewalls and encrypted communication. The advisory concludes with acknowledgments and a disclaimer regarding liability.
