Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2018-25048

Codesys Runtime Improper Limitation of a Pathname

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

CODESYS Control for BeagleBone

Default version status: unaffected

  • 3.0.0.0 to < 3.5.12.30affected

CODESYS Control for emPC-A/iMX6

Default version status: unaffected

  • 3.0.0.0 to < 3.5.12.30affected

CODESYS Control for IOT2000

Default version status: unaffected

  • 3.0.0.0 to < 3.5.12.30affected

CODESYS Control for PFC100

Default version status: unaffected

  • 3.0.0.0 to < 3.5.12.30affected

CODESYS Control for PFC200

Default version status: unaffected

  • 3.0.0.0 to < 3.5.12.30affected

CODESYS Control for Raspberry Pi

Default version status: unaffected

  • 3.0.0.0 to < 3.5.12.30affected

CODESYS Control RTE V3 (all variants)

Default version status: unaffected

  • 3.0.0.0 to < 3.5.12.30affected

CODESYS Control Win V3 (all variants)

Default version status: unaffected

  • 3.0.0.0 to < 3.5.12.30affected

CODESYS V3 Simulation Runtime (part of the CODESYS Development System)

Default version status: unaffected

  • 3.0.0.0 to < 3.5.12.30affected

CODESYS HMI V3 (all variants)

Default version status: unaffected

  • 3.0.0.0 to < 3.5.12.30affected

CODESYS V3 Remote Target Visu (all variants)

Default version status: unaffected

  • 3.0.0.0 to < 3.5.12.30affected

CODESYS Control V3 Runtime System Toolkit

Default version status: unaffected

  • 3.0.0.0 to < 3.5.12.30affected

CODESYS V3 Embedded Target Visu Toolkit

Default version status: unaffected

  • 3.0.0.0 to < 3.5.12.30affected

CODESYS V3 Remote Target Visu Toolkit

Default version status: unaffected

  • 3.0.0.0 to < 3.5.12.30affected

CODESYS Runtime Toolkit 32 bit embedded

Default version status: unaffected

  • 2.0.0.0 to < 2.3.2.10affected

CODESYS Runtime Toolkit 32 bit full

Default version status: unaffected

  • 2.0.0.0 to < 2.4.7.52affected

CODESYS Runtime PLCWinNT

Default version status: unaffected

  • 2.0.0.0 to < 2.4.7.52affected

References