Bosch PSIRT

Denial of Service in PLC Runtime affecting Rexroth IndraMotion Products

BOSCH-SA-152060

Advisory Information

Summary

The control systems IndraMotion MTX, MLC and MLD sold by Bosch Rexroth contain technology from CODESYS GmbH. The manufacturer published security bulletins [1], [2] about weaknesses in the communication interface of the PLC runtime. By exploiting these vulnerabilities, the control device can be put into a state in which network queries are no longer answered. To restore the device to a proper state, it must be restarted.

These vulnerabilities affect all available software versions of Rexroth IndraMotion MTX, MLC and MLD.

Affected Products

  • Rexroth IndraMotion MLC
  • Rexroth IndraMotion MLD
  • Rexroth IndraMotion MTX

Solution and Mitigations

Use ctrlX CORE

A CODESYS version with resolved security issues is integrated in ctrlX CORE.

Apply DC Security Policy

It is strongly recommended to implement the measures for network segmentation described in the DC Security Policy (see “Security Manual Electric Drives and Controls” [3]), especially if the use of ctrlX CORE is not possible.

Vulnerability Details

CVE-2019-5105

Rexroth IndraMotion MTX, MLC and MLC are affected by CVE-2019-5105.

CVE description: An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService. A specially crafted packet can cause a large memcpy, resulting in an access violation and termination of the process. An attacker can send a packet to a device running the GatewayService.exe to trigger this vulnerability. All variants of the CODESYS V3 products in all versions prior V3.5.16.10 containing the CmpRouter or CmpRouterEmbedded component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PLCnext, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS Control V3 Runtime System Toolkit, CODESYS V3 Embedded Target Visu Toolkit, CODESYS V3 Remote Target Visu Toolkit, CODESYS V3 Safety SIL2, CODESYS Edge Gateway V3, CODESYS Gateway V3, CODESYS HMI V3, CODESYS OPC Server V3, CODESYS PLCHandler SDK, CODESYS V3 Simulation Runtime (part of the CODESYS Development System).

CVE-2020-7052

Rexroth IndraMotion MTX, MLC and MLC are affected by CVE-2020-7052.

CVE description: CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition.

Remark

Vulnerability classification has been performed using the CVSS v3.1 scoring system . The CVSS environmental score is specific to each customer’s environment and should be defined by the customer to attain a final scoring.

Additional Resources

Please contact the Bosch PSIRT if you have feedback, comments, or additional information about this vulnerability at: psirt@bosch.com .

Revision History

  • 16 Dec 2020: Initial Publication