CVE-2023-41374
📋 TL;DR
A double free vulnerability in Kostac PLC Programming Software allows arbitrary code execution when users open specially crafted project files. This affects versions 1.6.11.0 and earlier, particularly when opening project files saved with versions 1.6.9.0 and earlier. Industrial control system operators and engineers using this software are at risk.
💻 Affected Systems
- Kostac PLC Programming Software
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the engineering workstation, potentially enabling lateral movement to PLCs and industrial networks.
Likely Case
Local privilege escalation or remote code execution on the engineering workstation when malicious project files are opened.
If Mitigated
No impact if proper file validation and software updates are implemented as recommended by the vendor.
🎯 Exploit Status
Exploitation requires user interaction to open malicious project files. The vulnerability is in parsing KPP project files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.6.10.0 or later
Vendor Advisory: https://www.electronics.jtekt.co.jp/en/topics/202309125391/
Restart Required: Yes
Instructions:
1. Download Kostac PLC Programming Software Version 1.6.10.0 or later from official vendor sources. 2. Install the update following vendor instructions. 3. Restart the system. 4. Re-save all existing project files using the updated software to apply protection mechanisms.
🔧 Temporary Workarounds
Project File Re-saving
windowsRe-save all existing project files using Kostac PLC Programming Software Version 1.6.10.0 or later to apply file alteration prevention
File Access Restrictions
allRestrict opening of KPP project files from untrusted sources and implement file integrity checking
🧯 If You Can't Patch
- Isolate engineering workstations from general network access and implement strict file transfer controls
- Implement application whitelisting to prevent execution of unauthorized code and monitor for suspicious file parsing activities
🔍 How to Verify
Check if Vulnerable:
Check software version in Help > About or program properties. If version is 1.6.11.0 or earlier, system is vulnerable.Check Version:
Check application properties or use Windows 'wmic product get name,version' to identify installed versionVerify Fix Applied:
Verify software version is 1.6.10.0 or later and confirm project files have been re-saved using the updated version.📡 Detection & Monitoring
Log Indicators:
- Unexpected crashes of Kostac software
- Unusual file parsing errors in application logs
- Creation of unexpected processes from Kostac executable
Network Indicators:
- Unusual outbound connections from engineering workstation following file opening
- File transfers of KPP project files from untrusted sources
SIEM Query:
Process Creation where Image contains 'kostac' AND ParentImage contains 'explorer.exe' AND CommandLine contains '.kpp'