Denial of Service in PLC Runtime affecting Rexroth IndraMotion Products
- Advisory ID: BOSCH-SA-152060
- CVE Numbers and CVSS v3.1 Scores:
- Published: 16 Dec 2020
- Last Updated: 16 Dec 2020
The control systems IndraMotion MTX, MLC and MLD sold by Bosch Rexroth contain technology from CODESYS GmbH. The manufacturer published security bulletins ,  about weaknesses in the communication interface of the PLC runtime. By exploiting these vulnerabilities, the control device can be put into a state in which network queries are no longer answered. To restore the device to a proper state, it must be restarted.
These vulnerabilities affect all available software versions of Rexroth IndraMotion MTX, MLC and MLD.
- Rexroth IndraMotion MLC
- Rexroth IndraMotion MLD
- Rexroth IndraMotion MTX
Solution and Mitigations
Use ctrlX CORE
A CODESYS version with resolved security issues is integrated in ctrlX CORE.
Apply DC Security Policy
It is strongly recommended to implement the measures for network segmentation described in the DC Security Policy (see “Security Manual Electric Drives and Controls” ), especially if the use of ctrlX CORE is not possible.
Rexroth IndraMotion MTX, MLC and MLC are affected by CVE-2019-5105.
CVE description: An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService. A specially crafted packet can cause a large memcpy, resulting in an access violation and termination of the process. An attacker can send a packet to a device running the GatewayService.exe to trigger this vulnerability. All variants of the CODESYS V3 products in all versions prior V184.108.40.206 containing the CmpRouter or CmpRouterEmbedded component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PLCnext, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS Control V3 Runtime System Toolkit, CODESYS V3 Embedded Target Visu Toolkit, CODESYS V3 Remote Target Visu Toolkit, CODESYS V3 Safety SIL2, CODESYS Edge Gateway V3, CODESYS Gateway V3, CODESYS HMI V3, CODESYS OPC Server V3, CODESYS PLCHandler SDK, CODESYS V3 Simulation Runtime (part of the CODESYS Development System).
- Problem Type:
CVSS Vector String:
- Base Score: 7.5 (High)
Rexroth IndraMotion MTX, MLC and MLC are affected by CVE-2020-7052.
CVE description: CODESYS Control V3, Gateway V3, and HMI V3 before 220.127.116.11 allow uncontrolled memory allocation which can result in a remote denial of service condition.
- Problem Type:
CVSS Vector String:
- Base Score: 7.1 (High)
Vulnerability classification has been performed using the CVSS v3.1 scoring system . The CVSS environmental score is specific to each customer’s environment and should be defined by the customer to attain a final scoring.
-  CODESYS Security Advisory ID 2020-01: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12977&token=33f948eed0c2fd69d238d9515779be337ef7592d&download=
-  CODESYS Security Advisory ID 2020-02: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13077&token=3bfc6d1d08415a6260b96093520071f5786e7fd4&download=
-  Security Manual Electric Drives and Controls: https://www.boschrexroth.com/various/utilities/mediadirectory/download/index.jsp?object_nr=R911342562
Please contact the Bosch PSIRT if you have feedback, comments, or additional information about this vulnerability at: firstname.lastname@example.org .
- 16 Dec 2020: Initial Publication