The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.
References
| Link | Resource |
|---|---|
| https://customers.codesys.com/fileadmin/data/customers/security/2018/Advisory2018-04_CDS-59017.pdf | Not Applicable |
Configurations
Configuration 1 (hide)
|
History
30 Mar 2023, 17:50
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:codesys:control_for_pfc200:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_rte:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_for_empc-a\/imx6:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_win:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:runtime_plcwinnt:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:runtime_system_toolkit:*:*:*:*:*:*:x86:* cpe:2.3:a:codesys:embedded_target_visu_toolkit:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:runtime_system_toolkit:3.5.15.0:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_v3_runtime_system_toolkit:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_for_beaglebone:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:remote_target_visu_toolkit:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:hmi:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_for_raspberry_pi:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_for_pfc100:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:control_for_iot2000:*:*:*:*:*:*:*:* cpe:2.3:a:codesys:simulation_runtime:*:*:*:*:*:*:*:* |
|
| References | (MISC) https://customers.codesys.com/fileadmin/data/customers/security/2018/Advisory2018-04_CDS-59017.pdf - Not Applicable |
23 Mar 2023, 13:41
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-23 11:15
Updated : 2024-02-04 23:37
NVD link : CVE-2018-25048
Mitre link : CVE-2018-25048
CVE.ORG link : CVE-2018-25048
JSON object : View
Products Affected
codesys
- control_rte
- control_for_iot2000
- control_for_raspberry_pi
- control_win
- embedded_target_visu_toolkit
- control_v3_runtime_system_toolkit
- hmi
- remote_target_visu_toolkit
- simulation_runtime
- control_for_beaglebone
- control_for_pfc200
- runtime_system_toolkit
- runtime_plcwinnt
- control_for_empc-a\/imx6
- control_for_pfc100
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')