Summary
This document is a security advisory detailing a vulnerability in the CODESYS web server component of the CODESYS Control runtime system. The advisory outlines that a specific crafted TLS packet sent over an HTTPS connection can cause the web server to crash due to improper checking of return values in an underlying function. It identifies affected products, including various versions of CODESYS Control RTE, HMI, and other toolkits, specifying that all versions before 3.5.20.30 and 4.14.0.0 are impacted. The advisory includes vulnerability identifiers such as CVE-2024-8175 and provides a CVSS v3.1 Base Score of 7.5, categorizing the severity as high. It also details remediation steps, recommending updates to specific product versions to mitigate the vulnerability. Additionally, general security recommendations are provided to enhance the security posture of CODESYS products and environments. Acknowledgments for reporting the issue and further contact information for support are included.
