CoDe16; 16 Zero-Day Vulnerabilities Affecting CODESYS Framework Leading to Remote Code Execution
summary
Finds 16 zero-days in the CODESYS SDK that yield remote code execution on millions of devices across hundreds of vendors; analysis uses firmware dumps, IDA Pro, string/table heuristics and reconstruction of a proprietary network protocol keyed by 55CD magic. Vulnerabilities are mainly stack-based overflows in service handlers (app, trace manager, device auth) plus hardcoded crypto enabling credential theft via sniffed login packets. Exploits demonstrate ASLR/DEP bypasses (power‑cycle restore, ROP gadgets), a stealthy chunked app uploader and a direct elevator crash by corrupting global variables.
AI-written summary · about
chapters (17)
- 0:00CODESYS research intro
- 1:51Why CODESYS is critical
- 2:33Firmware extraction setup
- 5:04CODESYS protocol layers
- 10:04Vulnerabilities in components
- 11:51Stack overflow in App Handler
- 13:14Stack overflow in Trace Manager
- 14:41Weak password encryption
- 15:4516 zero-day vulnerabilities
- 16:27Credential theft for hijacking
- 17:53Exploiting stack overflow RCE
- 19:37Bypassing TM 251 protections
- 21:47CODESYS memory segments
- 24:17Bypassing Wago PFC 200 protections
- 26:44RCE on Schneider elevator
- 29:50Manipulating elevator physics
- 32:17Key takeaways and security recommendations
related talks
40mUnveiling the Secrets of Codesys V3: ZeroDays, Forensic Artifacts and More
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS
37mCDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-Days
51mArm IDA and Cross Check: Reversing the Boeing 787's Core Network
28mUnveiling Remote Code Execution: How Vulnerabilities Lead to System Takeovers
29mFrom an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single Packet
45mThe Code Behind The Vulnerability
40mSomething Rotten in the State of Data Centers