Summary
This document is a security advisory from CODESYS Group detailing a physical side-channel vulnerability affecting the CODESYS Key USB dongle, which utilizes WIBU CodeMeter technology. The advisory specifies that CODESYS Keys with serial numbers starting with '3-' and firmware versions prior to 4.52 are impacted. The document includes vulnerability identifiers, such as CVE-2024-45678, and provides a CVSS v3.1 base score of 4.9, indicating a medium severity level. The advisory outlines the potential impact of the vulnerability, which requires physical access to exploit, and recommends updating the firmware to version 4.52 to mitigate the risk. Additionally, it emphasizes the importance of restricting physical access to the CODESYS Key and suggests best-practice defense measures to enhance security. These measures include using protected environments, firewalls, user management, encrypted communication, and VPNs. The advisory concludes with acknowledgments and a disclaimer regarding liability.
