CVE-2021-29242
HIGHCVSS 7.3/10EPSS 1.07%
Last modified
CVE-2021-29242 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.. EPSS estimates a 1.07% chance of exploitation in the next 30 days.
Description
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Codesys | Control For Beaglebone Sl | >= 3.0, < 4.1.0.0 |
| Codesys | Control For Empc-A\/Imx6 Sl | >= 3.0, < 4.1.0.0 |
| Codesys | Control For Iot2000 Sl | >= 3.0, < 4.1.0.0 |
| Codesys | Control For Linux Arm Sl | >= 3.0, < 4.1.0.0 |
| Codesys | Control For Linux Sl | >= 3.0, < 4.1.0.0 |
| Codesys | Control For Pfc100 Sl | >= 3.0, < 4.1.0.0 |
| Codesys | Control For Pfc200 Sl | >= 3.0, < 4.1.0.0 |
| Codesys | Control For Plcnext Sl | >= 3.0, < 4.1.0.0 |
| Codesys | Control For Raspberry Pi Sl | >= 3.0, < 4.1.0.0 |
| Codesys | Control For Wago Touch Panels 600 Sl | >= 3.0, < 4.1.0.0 |
| Codesys | Control Rte | >= 3.0, < 3.5.17.0 |
| Codesys | Control Runtime System Toolkit | >= 3.0, < 3.5.17.0 |
| Codesys | Control Win | >= 3.0, < 3.5.17.0 |
| Codesys | Edge Gateway | >= 3.0, < 3.5.17.0 |
| Codesys | Edge Gateway | >= 3.0, < 4.1.0.0 |
| Codesys | Embedded Target Visu Toolkit | >= 3.0, < 3.5.17.0 |
| Codesys | Gateway | >= 3.0, < 3.5.17.0 |
| Codesys | Hmi | >= 3.0, < 3.5.17.0 |
| Codesys | Opc Server | >= 3.0, < 3.5.17.0 |
| Codesys | Plchandler | >= 3.0, < 3.5.17.0 |
| Codesys | Remote Target Visu Toolkit | >= 3.0, < 3.5.17.0 |
| Codesys | Safety Sil | >= 3.0, < 3.5.17.0 |
| Codesys | Simulation Runtime | >= 3.0, < 3.5.17.0 |
References
- https://customers.codesys.com/index.phpPermissions Required, Vendor Advisory
- https://www.codesys.com/security/security-reports.htmlVendor Advisory
- https://customers.codesys.com/index.phpPermissions Required, Vendor Advisory
- https://www.codesys.com/security/security-reports.htmlVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-29242?
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.
How severe is CVE-2021-29242?
CVE-2021-29242 has a CVSS score of 7.3/10 (HIGH severity). The EPSS model estimates a 1.07% probability of exploitation in the next 30 days.
How do I fix CVE-2021-29242?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-29220Multiple buffer overflow security vulnerabilities have been …7.2
- CVE-2021-29221A local privilege escalation vulnerability was discovered in…7
- CVE-2021-29238CODESYS Automation Server before 1.16.0 allows cross-site re…8.8
- CVE-2021-29239CODESYS Development System 3 before 3.5.17.0 displays or exe…7.8
- CVE-2021-29240The Package Manager of CODESYS Development System 3 before 3…7.8
- CVE-2021-29241CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer derefe…7.5
- CVE-2021-29243Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XS…6.1
- CVE-2021-29245BTCPay Server through 1.0.7.0 uses a weak method Next to pro…5.3
- CVE-2021-29246BTCPay Server through 1.0.7.0 suffers from directory travers…6.7
- CVE-2021-29247BTCPay Server through 1.0.7.0 could allow a remote attacker …5.3
- CVE-2021-29248BTCPay Server through 1.0.7.0 could allow a remote attacker …5.3
- CVE-2021-29249BTCPay Server before 1.0.6.0, when the payment button is use…7.5
Are you affected by CVE-2021-29242?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST