Summary
This document is a security advisory detailing a vulnerability in the OSCAT Basic library, which is developed by OSCAT for use in IEC 61131-3-compliant programming tools. The advisory outlines that the MONTH_TO_STRING function within the library is susceptible to an out-of-bounds read vulnerability, potentially allowing unauthorized access to internal data or causing a crash of the PLC. The document specifies that all versions prior to 3.3.5 are affected and provides identifiers for the vulnerability, including CVE-2024-6876 and CVSS v3.1 Base Score of 5.1, indicating a medium severity level. It recommends updating the library to version 3.3.5 to mitigate the risk. Additionally, it suggests validating all input values in the PLC program to prevent exploitation of the vulnerability. General security recommendations are also provided to enhance the security posture of control systems, including the use of firewalls, user management, and encrypted communication links.
