CVE-2021-21868: An unsafe deserialization vulnerability exists in the ObjectManager.plugin

An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A

Status

Published

2021-08-18

Updated

2024-08-03

Assigning organization

talos

Description

An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a CODESYS

CODESYS GmbH CODESYS Development System 3.5.16, CODESYS GmbH CODESYS Development System 3.5.17affected

References

https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16805&token=ee583c498941d9fda86490bca98ff21928eec08a&download= ↗
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1305 ↗