FESTO CODESYS Gateway Server authentication and DoS flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Three remote vulnerabilities in FESTO CODESYS Gateway Server V2 allow unauthenticated attackers to bypass authentication, exhaust connections, or crash via memory exhaustion.
FESTO CODESYS Gateway Server V2 contains three unauthenticated remote vulnerabilities affecting industrial control systems worldwide. CVE-2022-31802 (CVSS 9.8) is a partial string comparison flaw in password validation that allows attackers to authenticate by submitting a truncated password matching only the beginning of the real password. CVE-2022-31803 (CVSS 5.3) enables connection exhaustion: an attacker can establish numerous TCP connections without authentication to consume all available slots and block legitimate users or clients. CVE-2022-31804 (CVSS 7.5) permits memory exhaustion by sending requests with arbitrarily large size values, causing out-of-memory crashes. All three require no authentication, have low attack complexity, and are remotely exploitable over the network. CISA reports no known public exploitation at the time of publication. Festo recommends enabling password protection if none is configured; the critical mitigation is to restrict network access to the Gateway Server, place it behind firewalls, and isolate it from business networks. Organizations should update to FESTO CODESYS Gateway Server V2.3.9.38 or later.
Mentioned in this report
Detection guidance
Inbound Connections to CODESYS Gateway Service Process
Sysmon shows inbound TCP connections accepted by the CODESYS GatewayService.exe on port 1217. A burst from one source can mean connection exhaustion (CVE-2022-31803) or unauthenticated abuse (CVE-2022-31802/31804). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Inbound Connections to CODESYS Gateway Service Process
id: 80d351ca-7a0e-5b81-94b8-20e87ec76de2
status: experimental
description: Detects inbound TCP connections accepted by the CODESYS Gateway Server
process (GatewayService.exe) on its default port 1217. The vulnerabilities in the
report need no authentication, so exploitation looks like many connections from
one source in a short time. Alert on a high count per source IP within a few minutes;
this threshold must be applied in the SIEM and is not encoded in the rule. Also
review connections from sources outside the engineering workstation set.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-03
tags:
- attack.impact
- attack.t1499.004
- attack.t1498.001
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \GatewayService.exe
Initiated: 'false'
DestinationPort: 1217
filter_local:
SourceIp:
- 127.0.0.1
- ::1
condition: selection and not filter_local
falsepositives:
- Legitimate CODESYS engineering workstations and HMI clients connecting to the gateway
- Vulnerability or asset scanners that probe the ICS network
level: medium
author: Vorant
CODESYS Gateway Port 1217 Reached From Non-Private Address
Firewall logs show traffic to the CODESYS Gateway port 1217 from a public source address. The gateway should be isolated from business and internet networks, and the flaws are exploitable remotely without authentication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: CODESYS Gateway Port 1217 Reached From Non-Private Address
id: 2b38b3f2-02b5-59bb-bff4-c9d79cd11b5d
status: experimental
description: Detects firewall-logged traffic to TCP port 1217, the default CODESYS
Gateway Server port, from a non-RFC1918 source. The report's mitigation is to keep
the gateway behind firewalls and off business networks, so external access suggests
exposure and possible exploitation (password truncation bypass, connection exhaustion,
memory exhaustion). Repeated hits from one source should be escalated; the count
threshold must be applied in the SIEM.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-03
tags:
- attack.impact
- attack.t1498.001
- attack.t1499.004
- attack.credential-access
- attack.t1110.001
logsource:
category: firewall
detection:
selection:
dst_port: 1217
filter_private:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
condition: selection and not filter_private
falsepositives:
- Authorised remote engineering access from a known public VPN egress or vendor support
address
- Internet-wide scanners hitting an exposed host, which is itself a finding
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-03
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs