CVE-2021-36764
📋 TL;DR
CVE-2021-36764 is a NULL pointer dereference vulnerability in CODESYS Gateway V3 that allows attackers to cause denial-of-service conditions by sending crafted communication requests. This affects industrial control systems using CODESYS Gateway for PLC programming and communication.
💻 Affected Systems
- CODESYS Gateway V3
📦 What is this software?
Gateway by Codesys
⚠️ Risk & Real-World Impact
Worst Case
Complete denial-of-service of CODESYS Gateway, disrupting industrial control system communications and potentially halting production processes.
Likely Case
Temporary service disruption requiring manual restart of the CODESYS Gateway service.
If Mitigated
Minimal impact if systems are isolated and patched, with only brief service interruptions.
🎯 Exploit Status
Exploitation requires sending crafted network packets to the CODESYS Gateway service port (typically 1217/TCP).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.17.10 or later
Vendor Advisory: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16804&token=d8c89c887979b22fdfc9fd5c3aa3804bbb1ddbff&download=
Restart Required: Yes
Instructions:
1. Download CODESYS Gateway V3 version 3.5.17.10 or later from CODESYS customer portal. 2. Stop the CODESYS Gateway service. 3. Install the updated version. 4. Restart the service.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to CODESYS Gateway service port (1217/TCP) to only trusted systems.
Firewall Rules
allImplement firewall rules to block external access to CODESYS Gateway port.
# Windows: netsh advfirewall firewall add rule name="Block CODESYS Gateway" dir=in action=block protocol=TCP localport=1217
# Linux: iptables -A INPUT -p tcp --dport 1217 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate CODESYS Gateway from untrusted networks.
- Deploy intrusion detection systems to monitor for anomalous traffic patterns to port 1217/TCP.
🔍 How to Verify
Check if Vulnerable:
Check CODESYS Gateway version in the CODESYS Gateway Manager or via the web interface.Check Version:
# Windows: Check installed programs in Control Panel or CODESYS Gateway Manager
# Linux: Check package version with dpkg -l | grep codesys or rpm -qa | grep codesysVerify Fix Applied:
Verify installed version is 3.5.17.10 or later and test gateway functionality.📡 Detection & Monitoring
Log Indicators:
- CODESYS Gateway service crashes or restarts
- Error logs containing null pointer or access violation messages
Network Indicators:
- Unusual traffic patterns to port 1217/TCP
- Malformed packets sent to CODESYS Gateway port
SIEM Query:
source="codesys_gateway.log" AND ("crash" OR "restart" OR "null pointer" OR "access violation")