CVE-2021-30192
📋 TL;DR
CVE-2021-30192 is an improper security check vulnerability in CODESYS V2 Web-Server that allows attackers to bypass authentication and gain unauthorized access. This affects industrial control systems using CODESYS V2 Web-Server versions before 1.1.9.20. Attackers can exploit this to execute arbitrary code or manipulate PLC operations.
💻 Affected Systems
- CODESYS V2 Web-Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems leading to physical damage, production shutdown, or safety incidents via remote code execution on PLCs.
Likely Case
Unauthorized access to PLC programming and configuration, manipulation of industrial processes, data theft, or denial of service.
If Mitigated
Limited impact if systems are isolated, patched, or have additional network segmentation and access controls.
🎯 Exploit Status
Exploitation requires network access to the web server port (typically 80/443 or 8080). The vulnerability allows bypassing authentication checks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.9.20
Vendor Advisory: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14726&token=553da5d11234bbe1ceed59969d419a71bb8c8747&download=
Restart Required: Yes
Instructions:
1. Download CODESYS V2 Web-Server version 1.1.9.20 or later from CODESYS customer portal. 2. Stop the CODESYS service. 3. Install the updated version. 4. Restart the service. 5. Verify the version is 1.1.9.20 or higher.
🔧 Temporary Workarounds
Network Isolation
allRestrict network access to CODESYS Web-Server to only trusted management networks
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="TRUSTED_NETWORK" port port="80" protocol="tcp" accept'
netsh advfirewall firewall add rule name="CODESYS_Web" dir=in action=allow protocol=TCP localport=80 remoteip=TRUSTED_NETWORK
Disable Web Server
allTemporarily disable the CODESYS V2 Web-Server if not required for operations
systemctl stop codesys-web
sc stop "CODESYS Web Server"
🧯 If You Can't Patch
- Implement strict network segmentation to isolate CODESYS systems from untrusted networks
- Deploy application-level firewalls or WAFs with rules to block unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check CODESYS Web-Server version via web interface at http://<ip>:80/ or using system services listCheck Version:
On Windows: sc query "CODESYS Web Server" | findstr "VERSION" | On Linux: codesys-web --versionVerify Fix Applied:
Verify version is 1.1.9.20 or higher in CODESYS Web-Server about page or service properties📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /webvisu/ or /plc/ paths
- Authentication bypass logs in CODESYS audit logs
- Unexpected PLC programming sessions
Network Indicators:
- Unusual HTTP requests to CODESYS web ports from unauthorized sources
- Traffic patterns indicating PLC manipulation
SIEM Query:
source="codesys.log" AND (event_type="auth_failure" OR event_type="unauthorized_access")🔗 References
- https://customers.codesys.com/index.php
- https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14726&token=553da5d11234bbe1ceed59969d419a71bb8c8747&download=
- https://customers.codesys.com/index.php
- https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14726&token=553da5d11234bbe1ceed59969d419a71bb8c8747&download=
